Snort: Anyone recommend a good log analyzer

Can anyone recommend a good log analyzer for snort. Something that will scan through the alerts and output pretty webpages out of it?

In the past I have used snortsnarf, and was wondering if there are newer progs out there that can do the job better.

Thanks in advance.

Grinler

I have been using ACID - Analysis Console for Intrusion Databases for my snort implementation for about the past year and I am pretty happy with it.

Check it out.


Cheers:

Thanks alot

Demarc is good as well, kind of a shame it isn't free anymore...

/nebulus

Neb: It's free for personal and non-profit use.... I checked the license the other day. I got a scare when I went there cos the site has changed a little but the personal version is still there. I d/led it and am running it on a machine that is hard to get to, (read: locked down), so rather than jump through hoops to get a good connection I just terminal servered into it and d/led a new copy.

anyone notice how this showed up on the main page?

"Snort: Anyone recommend a good log anal

Sick: Yes, but my mind was in predictive mode and I could "see" the "yzer"...... ;)

Id say hands down Demarc PureSecure is the best. Ive examined quite a few of them. IDSCenter has made some changes and can be "appealing" for windows users. But in terms of data management in a professional format that can be used multi-platform PureSecure has it. Also as a bonus you get HID's with it.

The personal version is still free. Do not get the professional version because you will get locked out of administrative privaleges on the management console after 30 days.

Quote:

---

Originally posted here by Tiger Shark
Sick: Yes, but my mind was in predictive mode and I could "see" the "yzer"...... ;)

---

i knew there was an "yzer" or "ist" at the end. just caught me off guard.

help i got 40 seconds, i get a RPC error and it turns my computer off all the time, help me please, sorry no more time

How to hijack a thread....just kidding. :D I know your having problems. What you seem to be experiencing is a side effect of the latest worm making the rounds.

Get info on the worm HERE

There is also a tool to remove it HERE


Good Luck.

I have installed SNORT on windows environment.... I also have active perl installed on my system... can i get a log analyzer which works on above environment......

Regards

Kalp

You could still use acid (which works with Apache and PHP) or IDS Policy Manager. You should be able to find all the analyzers and front ends in the contrib section of the downloads at snort.org :D

Thanks a lot Mitten.....

Shall try them