Welcome, Guest. Please login or register.
Did you miss your activation email?
+  pfSense Forum
|-+  pfSense English Support» Packages» Get Snort Alerts out of pfSense for email alerting?
Username:
Password:
 
Home Help Search Login Register
 

Pages: [1]   Go Down
« previous next »
  Print  
Author Topic: Get Snort Alerts out of pfSense for email alerting?  (Read 1269 times)
0 Members and 1 Guest are viewing this topic.
mevans336
Full Member
***
Offline Offline

Posts: 108


View Profile
« on: June 26, 2012, 07:27:04 pm »
Hello Everyone,

For those of you who have managed to get your Snort alerts out of pfSense and onto another machine for parsing or email alert generation, what solution have you found to be effective and reliable?

I'm especially interested in email alert generation.

Thanks!
Logged
mevans336
Full Member
***
Offline Offline

Posts: 108


View Profile
« Reply #1 on: June 29, 2012, 03:22:13 pm »
Yikes, no one?

Should I break Snort out onto its own box for enhanced functionality or is there another recommended IDS?
Logged
judex
Jr. Member
**
Offline Offline

Posts: 59


View Profile
« Reply #2 on: June 29, 2012, 04:58:10 pm »
"Enhanced functionality"? At the moment it would be great , if it would work at all...
Logged
2.1-BETA1 (amd64)
built on Sat Apr 20 19:56:40 EDT 2013
FreeBSD 8.3-RELEASE-p7
mevans336
Full Member
***
Offline Offline

Posts: 108


View Profile
« Reply #3 on: June 29, 2012, 05:36:31 pm »
Quote from: judex on June 29, 2012, 04:58:10 pm
"Enhanced functionality"? At the moment it would be great , if it would work at all...

I don't have a problem with Snort generating alerts. That part works fine for me. (Sorry, my two Snort installations work fine.)

I'd just like to know if anyone has a scheme for getting those alerts out of pfSense and generating emails based upon them.
Logged
Koti
Newbie
*
Offline Offline

Posts: 14



View Profile
« Reply #4 on: July 31, 2012, 12:34:24 am »
Why dont you send the snort alerts to some external syslog server and get email alerting.

 Smiley
Logged
kevross33
Jr. Member
**
Offline Offline

Posts: 37


View Profile
« Reply #5 on: July 31, 2012, 08:29:28 am »
Use unified2 and barnyard in Snort package to write it off to an external database and use snorby (snorby.org) to email you reports.
Logged
mevans336
Full Member
***
Offline Offline

Posts: 108


View Profile
« Reply #6 on: August 01, 2012, 02:20:06 pm »
Quote from: kevross33 on July 31, 2012, 08:29:28 am
Use unified2 and barnyard in Snort package to write it off to an external database and use snorby (snorby.org) to email you reports.

I tried this, but I could never get anything to populate in Snorby. I'll research it again.

You wouldn't happen to know of a good how-to on the web would you?
Logged
Pages: [1]   Go Up
  Print  
« previous next »
 
Jump to:  

 

Powered by SMF 1.1.18 | SMF © 2013, Simple Machines
Page created in 0.027 seconds with 20 queries.