I'm trying to determine if Sagan can do anything similar to fail2ban where detected attacks can be temporarily blacklisted, via a system's firewall (iptables). Does Sagan have any "countermeasures" or "active response" capabilities?


1 Answer 1


Googling I came upon this page titled: Snortsam - A Firewall Blocking Agent for Snort which is a plugin for Snort. According to this plugins page it can integrate with Sagan as well:


SnortSam has also been integrated with Sagan, which is a log analysis engine developed by Champ Clark. The Snortsam Output Plugin and related files (header, Twofish) are available at the Sagan GitHub repository.

SnortSam itself consists of two pieces -- the output plugin within Snort™ and an intelligent agent that runs on the firewall, or a host near the firewall. The agent provides a variety of capabilities that go beyond other automated blocking mechanisms, such as:

  • White-list support of IP addresses that will never be blocked.
  • Time-override list.
  • Maximum block time ceiling as well as minimum block time definition for reporting entities. Flexible, per rule blocking specification, including rule dependent blocking time interval.
  • A SID filter list of allowed or denied SIDs based on reporting entity.
  • Misuse/Attack detection engine (including roll-back support) that attempts to mitigate the risk of a self-inflicted Denial-Of-Service
    in the IDS-Firewall integration.
  • Repetitive (same IP) block prevention with customizable window to improve performance.
  • TwoFish encrypted communication between Snort™ and the SnortSam agent.
  • True OPSEC support using the Checkpoint SDK (opsec plugin).
  • Block tracking and block expiration for firewalls that don't support timeouts.
  • Multi-threading for faster processing and simultaneous block on multiple devices.
  • File logging and email notification of events. ... and finally, using the client/server (snort/snortsam) architecture to build large, distributed response networks in a very scalable fashion.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .