Slashdot Mirror

IDS (Intrusion Detection Systems) are all fine. Snort is in my opinion the best system around. The difficult part is the overview over the whole network. You can set up Snort at your border gateways to collect all the attacs, but in my experience you'll not pay attention to the alerts after a while (half a year). There are just to many alerts every day.

The best solution you can get so far is a product which was called "Demarc PureSecure" not long ago. It is based on Snort, does file integrity checks and monitors all your services, disk space, CPU and a lot more.

The cool thing about that solution is the web-based centralized management console. You can update the (Snort-)roule-sets at once, and have a look at all the attacks to your network in a browser window. It's the most sophisticated and most underestimated system around. Just have a look:

Demarc

Most of the commercial IDSs are based on snort, but the Demarc stuff is what you need for larger networks.

Disclamer: I don't have anything to do with the company behind Demarc, but I know, that this solution is pretty unknown to most of the admins out there.

>Check out Symantec's ManHunt. Besides getting great support, this uses open source software (snort) and now runs on Red Hat Linux!

I'd also recommended Puresecure Professional it's been a godsend.

Plus, they have a free version for homeusers.

If you want a commercial snort solution, I'd really recommend checking out PureSecure.

It adds a lot more functionality than any other front end I've found, and in the grand scheme of things isn't all that pricey for work. Plus they have a home version that's free.

Just my $.02

If you want a really good snort UI, go with PureSecure. You can get it over at http://demarc.com/

Check the screenshots, and you'll see what I mean.

It's not open source, but it is free for personal use and by far the best Ui for snort. We use it here at work. It also does some tripwire and Big brother type stuff.

If you want a really good snort UI, go with PureSecure. You can get it over at http://demarc.com/

Check the screenshots, and you'll see what I mean.

It's not open source, but it is free for personal use and by far the best Ui for snort. We use it here at work. It also does some tripwire and Big brother type stuff.

Yeah, I've been using PureSecure at home and at work for quite a while. The screenshots are what really peaked my interest, and being able to actually test it before buying it sold my manager on it. I've worked with a lot of IDS systems/front ends, and their's is by far the nicest. When I tried the older one it was kinda a chore to install, but the newest one has a badass installer that made things a snap. Not exactly Artificial Intelligence tho.

Demarc PureSecure was one software suite I looked at about a year ago. It's free for personal use, fee for commercial use. I'm not sure how their prices compare to other software packages, but it would be worth looking at. It's being marketed as a Total Intrusion Detection System, and monitors Snort logs, log files, disk space/usage, open ports, and more.

Things I like about it:

installation script is truly a marvel (installs snort, mysql, apache, perl modules)

Login screen/authentication

Big Brother like monitoring

File integrity checking

IDS using Snort sensors

free to use for non-commercial use

no I don't work for them I just like the software.

If you're checking out snort for the first time, I highly recommend using Demarc PureSecure which is free as in beer (aka for personal use). It's by far the best front end for snort, and does host based checks as well.

The screenshots are mouthwatering. :)

If you're checking out snort for the first time, I highly recommend using Demarc PureSecure which is free as in beer (aka for personal use). It's by far the best front end for snort, and does host based checks as well.

The screenshots are mouthwatering. :)