So far, we have focused on the real-time aspects of monitoring Snort alerts. Another aspect of data analysis is reporting. Reports generally do two things: provide statistical analysis of past events, and communicate information to other people. Statistical reports can help you to identify things such as the top 10 attackers, the top targeted machines, and the most active hosts. This information can be very useful for an analyst to get a grip on the data he is dealing with. On the communication side, you can use reports to pass information about specific servers to the operations team, help the networking team mitigate a DoS attack by reporting on traffic volumes, or deliver a report of all access to a financial system to auditors. If you are delivering services to other departments or customers, a very efficient way of communicating information is to use a Web portal, which lets the user choose and navigate his reports.

Serving different users generally requires that some kind of access control mechanism is built into the interface to make sure that users have access only to the event data they are authorized to access and which is necessary to fulfill their jobs. In a managed services environment, where one system hosts data from multiple different customers, it is not desirable (to put it mildly) for one customer to have access to another's data. OSSIM, for example, implements access control based on users. When setting up a user account, you can...