TABLE OF CONTENTS We saw earlier what the process of data analysis looks like. The main task in the process is to identify events of interest. Given a set of Snort alerts, we will now discuss in detail the process of finding the interesting events.
The quest for events of interest starts with the Snort alerts that have a low priority assigned. Remember, the lower the priority, the more important the event! It is fairly easy to extract these events, especially if your events are stored in a MySQL database.
This is the easy part. Now that we isolated all these events, we will start to work with watch lists. The first watch list we are going to compile is a Hst of our critical servers. This is a very manual process and you should take your time to compile a comprehensive list:
$ cat highvaluetargets.list192.168.10.2192.168.20.1192.168.20.5192.168.20.6
We have four machines on our high-value target List. The next list we generate is the "past aggressor" list. In fact, we are going to build a few different lists. The first list we are going to generate is one of prior sources that conducted reconnaissance. If you have a full alert log, this is how you generate your reconnaissance list:
$ grep "recon" alert -A 1 grep "\->" awk '{print $2}' sed -e 's/:.*//'I sort I uniq -c sort -nr head -1035523 217.118.195.111638 217.118.195.542655 217.118.195.582611 194.42.48.162229 217.118.199.121578 161.58.176.160515 217.118.192.109168 194.2.144.123153 205.166.76.893 216.74.145.68This...
