Snort IDS and Flower

November 20, 2010

Snort IDS Events and Flower

Over the last couple of weekends I've added the ability to capture and report on alerts generated by Snort IDS sensors. The additional code consists of: modifications to the Analysis Server to store and retrieve IDS related data, modifications to the Visualization Server to present that IDS data in a meaningful manner, and a new Python-based module that is installed on the IDS sensor itself.

That last component opens a local UNIX domain socket on the sensor. Snort is then configured to log alerts to that socket. When data is received on the open socket, the Python code parses the alert and opens a web services connection to the Analysis Server to deliver the results.

This is what the interface currently looks like with those modifications:

IDS Alert Console

IDS Alert Console

I only recently deployed the Snort sensor and it has not been tuned yet; that's why we see so many (portscan) alerts in the console above. I'm viewing the last 24 hours worth of alerts in this shot and have zeroed in on one of the less frequent alerts. All of the alerts shown are false positives, but their generation is good for my testing.

I haven't added the Python code to GitHub, but will be doing so shortly. I also plan to post another entry on this blog about configuring XenServer with Open vSwitch to better accommodate IDS functionality. I recently installed that software and configured a mirror port to monitor all local network activity on my VM server for the Flower Analysis server. The difference (from just using promiscuous mode on an interface) in visibility and efficiency is striking.

That vSwitch software comes with a bit of a learning curve, but the functionality it enables is very cool.