Tags:
create new tag
view all tags
Configuration with Sagan & Barnyard2 isn't that much different than Snort & Barnyard2. Sagan will need to have Unified2 support (libdnet support) built into it. For information about how to do that, see the SaganHOWTO page. Below is a "simple sample" configuration file. In this example, we'll just be storing the Sagan events to a standard MySQL Snort database using the standard Snort schema. Keep in mind that Barnyard2 supports many other output formats, and this is a simple example! Modifying this example to support MS SQL, Oracle, PostgreSQL, Prelude framework, Sguil, etc. should be pretty simple. <pre> ########################################################################### # Simple example Barnyard2 configuration file. If you understand how to used Barnyard2 # with Snort, then you already understand how to use Barnyard2 with Sagan :) ########################################################################### # Sagan reference file. Contains information about where to find URL's related to triggered # events. config reference_file: /usr/local/etc/sagan-rules/reference.config # Sagan classifications file. This stores the classification of an event and it's priority level. # Much of this is similar to Snort's classifications with a few extra Sagan classifications # added. config classification_file: /usr/local/etc/sagan-rules/classification.config # The is a message to "what generated" the event. Right now, this is not needed as Sagan # only has one generator. However, this is likely to changed in the near future. #config gen_file: /tmp/gen-msg.map # Sid (rule ID) to message map. This typically ships with the latest rule set. However, it # can be generated by oinkmaster's "create-sidmap.pl". config sid_file: /usr/local/etc/sagan-rules/sagan-sid-msg.map # The hostname of our Sagan sensor. config hostname: sagan-syslog # The "interface". In the IDS/IPS world, this would be something like "eth0". We don't really # have a "interface", so I typically set it to "syslog". config interface: syslog # Username/Group for Barnyard2 to run as. Remember, whatever user/group you set this to # has to have access to your Sagan unified2 output. config set_gid: sagan config set_uid: sagan # The "Where's Waldo" file. Keeps track of some counters used within the Snort database. config waldo_file: /var/log/barnyard2/barnyard2-sagan.waldo # Tell's Barnyard2 that the input from Sagan will indeed be Unified2. input unified2 # In this example, we'll be logging to a MySQL database with the standard Snort schema. Barnyard2 # supports many different output formats (MS SQL, Prelude, Sguil, PostgreSQL, etc). output database: log, mysql, user=barnyard password=mypassword dbname=my_snort_database host=192.168.0.1, detail full </pre> -- Main.ChampClark - 2011-03-15
E
dit
|
A
ttach
|
Watch
|
P
rint version
|
H
istory
: r1
|
B
acklinks
|
V
iew topic
|
Ra
w
edit
|
M
ore topic actions
Topic revision: r1 - 2011-03-15
-
ChampClark
Home
Site map
Main web
Sandbox web
TWiki web
Main Web
Users
Groups
Index
Search
Changes
Notifications
RSS Feed
Statistics
Preferences
P
View
Raw View
Print version
Find backlinks
History
More topic actions
Edit
Raw edit
Attach file or image
Edit topic preference settings
Set new parent
More topic actions
Account
Log In
E
dit
A
ttach
Copyright © 2008-2021 by the contributing authors. All material on this collaboration platform is the property of the contributing authors.
Ideas, requests, problems regarding TWiki?
Send feedback