Tags : Browse Projects

Snort is a lightweight network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth ... [More] port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more. Snort uses a flexible rule based language to describe traffic that it should collect or pass, and a modular detection engine. Snort has a real-time alerting capability, with alert mechanisms for syslog, a user specified file, a UNIX socket, or WinPopup messages to Windows clients using Samba's smbclient. [Less]

Barnyard2 offloads output processing of your IDS alert files to a dedicated process, minimizing dropped packets in the IDS itself. It parses unified2 files.

Modsec2sguil is a Perl script that feeds ModSecurity alerts to the Sguil open source NSM solution.