Sguil - Revision history

Edmund: /* References */

2017-01-29T21:44:54Z

References

← Older revision		Revision as of 00:44, 30 January 2017
Line 278:		Line 278:
	*[https://github.com/Security-Onion-Solutions/security-onion Security Onion Github Wiki]		*[https://github.com/Security-Onion-Solutions/security-onion Security Onion Github Wiki]
	[[Category:Operatsioonisüsteemide administreerimine ja sidumine]]		[[Category:Operatsioonisüsteemide administreerimine ja sidumine]]
	~~[[Category:Operating systems]]~~

Kkurval: /* See also */

2016-06-06T17:56:29Z

Kkurval at 17:52, 6 June 2016

2016-06-06T17:52:26Z

← Older revision		Revision as of 20:52, 6 June 2016
Line 258:		Line 258:
	===I'm not satisfied with the default packet logging subsystem. Are there any alternatives available?===		===I'm not satisfied with the default packet logging subsystem. Are there any alternatives available?===
	Yes. Two alternatives have already been developed, based on [[DaemonLogger] and [[SANCP]]. See [[Packet Logging in Sguil]] for more information on this subsystem and the alternatives available.		Yes. Two alternatives have already been developed, based on [[DaemonLogger] and [[SANCP]]. See [[Packet Logging in Sguil]] for more information on this subsystem and the alternatives available.
			=Summary=
			Sguil is a superb software to combine together a very large amount of IDS information while keeping every it sorted and very easily manageable. Additional tools in Security Onion also help to set up custom configuration with all analysis software a few clicks away. This gives a lot of possibility for automation of deep packet analysis. Clean installation and configuration of Sguil with all its dependencies is quite time consuming for a newcomer. But Security Onion can reduce this very to a reasonable time frame.

	=See also=		=See also=

Kkurval: /* References */

2016-06-06T17:44:20Z

References

← Older revision		Revision as of 20:44, 6 June 2016
Line 273:		Line 273:
	*[https://security-onion-solutions.github.io/security-onion/ Security Onion homepage]		*[https://security-onion-solutions.github.io/security-onion/ Security Onion homepage]
	*[https://en.wikipedia.org/wiki/Sguil Wikipedia Sguil]		*[https://en.wikipedia.org/wiki/Sguil Wikipedia Sguil]
			*[https://github.com/Security-Onion-Solutions/security-onion Security Onion Github Wiki]
	[[Category:Operatsioonisüsteemide administreerimine ja sidumine]]		[[Category:Operatsioonisüsteemide administreerimine ja sidumine]]
	[[Category:Operating systems]]		[[Category:Operating systems]]

Kkurval: /* References */

2016-06-06T17:43:07Z

References

← Older revision		Revision as of 20:43, 6 June 2016
Line 272:		Line 272:
	*[http://nsmwiki.org/Main_Page NSMWiki]: The official wiki for the Sguil project.		*[http://nsmwiki.org/Main_Page NSMWiki]: The official wiki for the Sguil project.
	*[https://security-onion-solutions.github.io/security-onion/ Security Onion homepage]		*[https://security-onion-solutions.github.io/security-onion/ Security Onion homepage]
			*[https://en.wikipedia.org/wiki/Sguil Wikipedia Sguil]
	[[Category:Operatsioonisüsteemide administreerimine ja sidumine]]		[[Category:Operatsioonisüsteemide administreerimine ja sidumine]]
	[[Category:Operating systems]]		[[Category:Operating systems]]

Kkurval: /* References */

2016-06-06T17:42:08Z

References

← Older revision		Revision as of 20:42, 6 June 2016
Line 271:		Line 271:
	*[http://nsmwiki.org/Sguil_FAQ Sguil FAQ]		*[http://nsmwiki.org/Sguil_FAQ Sguil FAQ]
	*[http://nsmwiki.org/Main_Page NSMWiki]: The official wiki for the Sguil project.		*[http://nsmwiki.org/Main_Page NSMWiki]: The official wiki for the Sguil project.
			*[https://security-onion-solutions.github.io/security-onion/ Security Onion homepage]
	[[Category:Operatsioonisüsteemide administreerimine ja sidumine]]		[[Category:Operatsioonisüsteemide administreerimine ja sidumine]]
	[[Category:Operating systems]]		[[Category:Operating systems]]

Kkurval: /* Software architecture */

2016-06-06T17:40:05Z

Software architecture

← Older revision		Revision as of 20:40, 6 June 2016
Line 27:		Line 27:

	Each sensor monitors a single network link (although you can have multiple sensors on one physical machine). They collect several different types of information:		Each sensor monitors a single network link (although you can have multiple sensors on one physical machine). They collect several different types of information:

			\|<---------> Sensor #1
			Client ==> Server <=========> \|<---------> Sensor #2
			\|<---------> Sensor #3

	# Snort monitors the link for security events, and logs them to a file on the local disk.		# Snort monitors the link for security events, and logs them to a file on the local disk.

Kkurval: /* Hardware */

2016-06-06T17:38:04Z

Hardware

← Older revision		Revision as of 20:38, 6 June 2016
Line 38:		Line 38:
	==Dependencies==		==Dependencies==
	===Hardware===		===Hardware===
	The hardware necessary to run sguil depends entirely upon the amount of network traffic you plan to monitor, how much of it you store and how long you store it. The public demonstration server at demo.sguil.net gets by with a 133MHz Pentium system, though for production systems you'll want something beefier.		The hardware necessary to run sguil depends entirely upon the amount of network traffic you plan to monitor, how much of it you store and how long you store it. The public demonstration server at demo.sguil.net gets by with a 133MHz Pentium system, though for production systems you'll want something beefier.

	For the sguil server, try to find something with a lot of memory and a fast disk. The MySQL database will need a lot of RAM for caching results from its queries, and a fast disk will speed up the access time while doing sequential searches.		For the sguil server, try to find something with a lot of memory and a fast disk. The MySQL database will need a lot of RAM for caching results from its queries, and a fast disk will speed up the access time while doing sequential searches.

	You may find it helpful to place the MySQL storage on a separate disk partition, or even a separate disk. It doesn't matter where you mount this storage area, but for convenience, I'll assume that that you're going to mount it on the same directory path you're using for the sensor data directory (see below), referred to in this document as $NSM.		You may find it helpful to place the MySQL storage on a separate disk partition, or even a separate disk. It doesn't matter where you mount this storage area, but for convenience, I'll assume that that you're going to mount it on the same directory path you're using for the sensor data directory (see below), referred to in this document as ''$NSM''.

	The following table is a useful guideline for a good server hardware configuration. Feel free to adjust it up or down depending on the size of your installation.		The following table is a useful guideline for a good server hardware configuration. Feel free to adjust it up or down depending on the size of your installation.

			{\| border="1" align="center"
			\|+ Recommended Server Hardware
			! CPU !! RAM !! Disk Storage
			\|-
			\| 3.0GHz \|\| 2GB \|\| 150GB (Consider a RAID5 array for speed & reliability)
			\|}

	===Software===		===Software===

Kkurval: /* Hardware */

2016-06-06T17:37:20Z

Hardware

← Older revision		Revision as of 20:37, 6 June 2016
Line 38:		Line 38:
	==Dependencies==		==Dependencies==
	===Hardware===		===Hardware===
			The hardware necessary to run sguil depends entirely upon the amount of network traffic you plan to monitor, how much of it you store and how long you store it. The public demonstration server at demo.sguil.net gets by with a 133MHz Pentium system, though for production systems you'll want something beefier.

			For the sguil server, try to find something with a lot of memory and a fast disk. The MySQL database will need a lot of RAM for caching results from its queries, and a fast disk will speed up the access time while doing sequential searches.

			You may find it helpful to place the MySQL storage on a separate disk partition, or even a separate disk. It doesn't matter where you mount this storage area, but for convenience, I'll assume that that you're going to mount it on the same directory path you're using for the sensor data directory (see below), referred to in this document as $NSM.

			The following table is a useful guideline for a good server hardware configuration. Feel free to adjust it up or down depending on the size of your installation.

	===Software===		===Software===

Kkurval: /* Hardware */

2016-06-06T17:36:35Z

Hardware

@@ Line 38: / Line 38: @@
 ==Dependencies==
 ===Hardware===
 ===Software===

← Older revision		Revision as of 20:56, 6 June 2016
Line 262:		Line 262:

	=See also=		=See also=
	~~{{Portal\|Free Software}}~~		* [https://en.wikipedia.org/wiki/Sagan_(software) Sagan]
	* [~~[Sagan~~ (software)\|Sagan]]		* [https://en.wikipedia.org/wiki/Intrusion_detection_system IDS]
	* [~~[Intrusion detection system]~~] ~~(IDS)~~		* [https://en.wikipedia.org/wiki/Intrusion_prevention_system IPS]
	* [~~[Intrusion prevention system~~]~~] (IPS)~~		* [https://en.wikipedia.org/wiki/Metasploit_Project Metasploit Project]
	* [~~[Network intrusion detection system]~~] ~~(NIDS)~~		* [https://en.wikipedia.org/wiki/Nmap NMAP]
	* [~~[Metasploit Project]~~]		* [https://www.snort.org/ SNORT]
	* [~~[nmap]~~]		* [https://www.bro.org/ BRO]

	=References=		=References=
	*[http://sguil.sourceforge.net Sguil Homepage]		*[http://sguil.sourceforge.net Sguil Homepage]