Data analysis is the process of identifying events of interest.

A Snort alert is, in many cases, the first sign of an intrusion. At the core of the alert message is a simple log of events of interest. This information includes a timestamp, IP addresses, and port information.

By following the data analysis process, it is possible to prioritize the Snort alerts and systematically identify the events of interest.

Visualization is an alternative and complementary way of identifying events of interest.

Once an incident is identified, evidence gathering helps you to collect important information to communicate and document the incident.

BASE works with MySQL and PostgreSQL databases.

To work properly, BASE needs a Web server with PHP and a set of PHP libraries installed.

The search feature allows database exploration and correlation of events.

Database management allows clearing of alerts or moving them into an archive database.

SGUIL is a powerful analysis platform for monitoring Snort events. It is written in Tcl/tk, making it available on many different platforms.

SGUIL can quickly query the database and generate incident reports.

SGUIL can even sanitize the report data so that your private IP information is not revealed.

Snort_stat.pl and SnortALog are Perl scripts that summarize Snort event information.

SnortSnarf processes Snort log files and creates a set of static HTML pages, with various details and correlations among the data. It can process a variety of events that are not...