Sguil

Author: Kustas Kurval

Cyber Security Engineering C11

Written 06.06.2016

Introduction

This tutorial was made to introduce Sguil. Sguil (pronounced sgweel) is built by network security analysts for network security analysts. It is a collection of free software components for Network Security Monitoring (NSM) and event driven analysis of IDS alerts. Sguil's main component is an intuitive GUI that provides access to realtime events, session data, and raw packet captures. Sguil facilitates the practice of Network Security Monitoring and event driven analysis.

The Sguil client is written in tcl / tk and can be run on any operating system that supports tcl / tk (including Linux, *BSD, Solaris, MacOS, and Win32).

It is provided by Q Public License

Sguil integrates alert data from Snort, session data from SANCP, and full content data from a second instance of Snort running in packet logger mode.

In this introduction I will be covering Sguil in Xbuntu. You will need to know basic Linux syntax and terminology also some terminology concerning overall intrusion detection and prevention systems (IDPS) and overall basic networking.

See also

• Sagan
• Intrusion detection system (IDS)
• Intrusion prevention system (IPS)
• Network intrusion detection system (NIDS)
• Metasploit Project
• nmap

References

• Sguil Homepage
• Sguil FAQ
• NSMWiki: The official wiki for the Sguil project.