General discussion about the Sguil project

Rene Borges | 22 May 19:48

SGUIL Sancp Issue on Agent Status Tab

We're in the process of migrating to SGUIL 0.8.x and we're running into an issue where Sancp presents a date that has passed under the "Last" column in the Agent Status tab. Do I have to recompile Sancp in a specific manner or is there another solution to that issue?

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/

_______________________________________________
Sguil-users mailing list
Sguil-users@...
https://lists.sourceforge.net/lists/listinfo/sguil-users

headers

Stefan Sabolowitsch | 2 May 19:15

sguil client, most current event in the group visibly, how?

Hi Bamm, all
Bamm i see in the event Group "only" the first Event and not the newest.
Thus it is to be found with difficulty out, which current event became to receive now (Client).
How can i guarantee that the most current events are visible always (Event Group an single Event)? 

Thanks for your time and help.

Stefan

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/

headers

Jeremy Hoel | 4 Apr 22:45

New interesting problem with tcpflow-1.2.3

So I'm standing up a new sguild server and I was grabbing tcpflow from
http://afflib.org/downloads/tcpflow.tar.gz.  Right now when that comes
down it's version 1.2.3.  It compiles like normal and installs and
runs fine, but the xcript doesn't seem to be able to use it when
pulling down transcripts/pcaps/etc.

I was able to roll back to the 1.1.0 version (tarball from the other
server) and it began to work like normal.

The afflib site lists 1.1.0 as the latest, but 1.2.3 is what comes down.

------------------------------------------------------------------------------
Better than sec? Nothing is better than sec when it comes to
monitoring Big Data applications. Try Boundary one-second 
resolution app monitoring today. Free.
http://p.sf.net/sfu/Boundary-dev2dev

headers

LIONEL PLAZA | 21 Mar 18:20

Sguil-0.8.0 client Wireshark TMP dir error

Hello Everyone,
I'm upgrading from sguil 7 to sguil 8 and so far so good.  I've ran
into snag with the sguil 8 client and wireshark.  The situation is
when I try to pull the pcap data with wireshark,  I get an error
"Permission Denied" to C:\tmp  or it never return any errors.  It's
the strangest thing because the directory is there and worked fine
with the sguil 7 client.  I've even changed the directory to a new
folder and completely opened up the security permissions for that
folder and I still get the same errors.  Using the transcripts options
works fine and I can see the raw packet on the archive folder.

Has anyone else experienced this problem?  If so, how do you fix it.

Thanks
-Leo

------------------------------------------------------------------------------
This SF email is sponsosred by:
Try Windows Azure free for 90 days Click Here 
http://p.sf.net/sfu/sfd2d-msazure

headers

Paul Marin | 28 Feb 21:59

What's log_packets.sh for?

Hi guys,

I don't really know what is the function of log_packets.sh in
sguil-sensor. What does this script do exactly? Why do you need to add
it to cron in order to run it periodically?

Thanks in advance,

Kindly

Paul

------------------------------------------------------------------------------
Keep Your Developer Skills Current with LearnDevNow!
The most comprehensive online learning library for Microsoft developers
is just $99.99! Visual Studio, SharePoint, SQL - plus HTML5, CSS3, MVC3,
Metro Style Apps, more. Free future releases when you subscribe now!
http://p.sf.net/sfu/learndevnow-d2d

headers

Paul Marin | 23 Feb 22:12

Request for pcap already in queue. Pls try again later

Hi Guys...

I tried to export an alert's full session to Wireshark and it never show
it. Then i tried it again and the sguil client showed me the following
message: "Request for pcap already in queue. Pls try again later"

After that i tried to export the full session again several times and i
still got the same message.

How can i fix this? I have already tried restarting the sguil-sensor
agents as well sguild and i am still getting the same message. What else
should i check?

Kindly,

Paul

------------------------------------------------------------------------------
Virtualization & Cloud Management Using Capacity Planning
Cloud computing makes use of virtualization - but cloud computing 
also focuses on allowing computing to be delivered as a service.
http://www.accelacomm.com/jaw/sfnl/114/51521223/

headers

Jamie Yu | 21 Feb 23:58

Sguil 0.8 on RHEL 6 setup guide available

Hi All,

I have published my setup guide here for those who are interested in building a Snort-Sguil IDS on RedHat/CentOS systems:

http://jamieyu.com/snort-sguil-ids/

If you have questions, please post it back to this mailing list. I think you'll get much better help here.

Thanks Bamm, for your great work on Sguil!

Regards,

Jamie

------------------------------------------------------------------------------
Keep Your Developer Skills Current with LearnDevNow!
The most comprehensive online learning library for Microsoft developers
is just $99.99! Visual Studio, SharePoint, SQL - plus HTML5, CSS3, MVC3,
Metro Style Apps, more. Free future releases when you subscribe now!
http://p.sf.net/sfu/learndevnow-d2d

_______________________________________________
Sguil-users mailing list
Sguil-users@...
https://lists.sourceforge.net/lists/listinfo/sguil-users

headers

Paul Marin | 6 Feb 22:59

SANCP and Sguil

Hi guys,

I am running sancp 1.6.1 and it has been set up to run in conjuction
with sguil 0.8.0. I installed sancp from source and followed the
instructions at http://nsmwiki.org/Sguil_on_RedHat_HOWTO#SANCP

I can see the sancp data being generated and also being saved into the
DB by sancp_agent.

I know that SANCP is used for recording TCP sessions but i don't know
where this data can bee seen through sguil client.

Sincerely, i don't see clearly the role of sancp in sguil since there is
already a transcript function being done by pcap_agent through which you
can have access to the TCP sessions.

I have also noticed that there is a tool called cxtracker that can
replace sancp. Do you guys recommend doing this? What are the advantages?

Thanks in advance for your help,

Kindly,

Paul

------------------------------------------------------------------------------
Try before you buy = See our experts in action!
The most comprehensive online learning library for Microsoft developers
is just $99.99! Visual Studio, SharePoint, SQL - plus HTML5, CSS3, MVC3,
Metro Style Apps, more. Free future releases when you subscribe now!
http://p.sf.net/sfu/learndevnow-dev2

headers

Jeremy Hoel | 3 Feb 17:19

CC field in client doesn't seem to work well

We did some testing this morning and if you do a Report -> Send Event
Detail via E-mail  and enter some addresses in the CC field, those do
not get sent.

Is there an open bug tracker somewhere to add these, or is this list
the best place.

------------------------------------------------------------------------------
Try before you buy = See our experts in action!
The most comprehensive online learning library for Microsoft developers
is just $99.99! Visual Studio, SharePoint, SQL - plus HTML5, CSS3, MVC3,
Metro Style Apps, more. Free future releases when you subscribe now!
http://p.sf.net/sfu/learndevnow-dev2

headers

Jeremy Hoel | 31 Jan 16:10

icmphdr tables

What's supposed to feed information into this set of tables?  From the
name it's icmp data, but all the sancp stuff goes to the sancp tables.
 Is this supposed to be filled from portscan data?  MIne seem to be
empty.

------------------------------------------------------------------------------
Keep Your Developer Skills Current with LearnDevNow!
The most comprehensive online learning library for Microsoft developers
is just $99.99! Visual Studio, SharePoint, SQL - plus HTML5, CSS3, MVC3,
Metro Style Apps, more. Free future releases when you subscribe now!
http://p.sf.net/sfu/learndevnow-d2d

headers

Jamie Yu | 30 Jan 22:34

Need help - pads not working on RHEL 6 64-bit server

Hi All,

I hope to get some help with pads issue I'm running into. I can't get it work on RHEL 6 64-bit server. I got Sguil 8 working, all except pads on sensor.

Download source pads-1.2-sguil-mods.tar.gz from: http://demo.sguil.net/downloads/ (This website is not opening, I had a copy downloaded from the same website back in 2008, so I'm using that copy).

Download pads.patch from: http://www.vorant.com/downloads.html

Patch and compile:

patch -p0 < ./pads.patch

./configure --prefix=/usr/local/pads-1.2-squil-mods

make

make install

Create symbolic links:

ln -s /usr/local/pads-1.2-squil-mods /usr/local/pads

ln -s /usr/local/pads/bin/pads /usr/local/bin/

Create /etc/sguil/pads.conf as following:

daemon 1

pid_file /var/run/sguil/pads.pid

interface eth1

network 192.168.1.0/24

output fifo: /nsm/snort_data/mysensor/pads.fifo

Run pads:

/usr/local/bin/pads -c /etc/sguil/pads.conf -u sguil -g sguil

Here's the error info in /var/log/messages (tried twice):

Jan 22 10:49:50 SENSOR pads: WARNING: pcap_lookupnet (eth1: no IPv4 address assigned)

Jan 22 10:49:50 SENSOR pads: Filter: (null)

Jan 22 10:49:50 SENSOR pads: Listening on interface eth1

Jan 22 10:49:50 SENSOR kernel: pads[7701]: segfault at 85356d8 ip 00000000004044be sp 00007fff216fc248 error 4 in pads[400000+d000]

Jan 22 11:09:18 SENSOR pads: WARNING: pcap_lookupnet (eth1: no IPv4 address assigned)

Jan 22 11:09:18 SENSOR pads: Filter: (null)

Jan 22 11:09:18 SENSOR pads: Listening on interface eth1

Jan 22 11:09:18 SENSOR kernel: pads[7773]: segfault at cb3226d8 ip 0000003c8ec47a67 sp 00007fff715c9680 error 4 in libc-2.12.so[3c8ec00000+186000]

I have re-compiled again, but still getting segfault error. Any suggestions?

Thanks.

Jamie

------------------------------------------------------------------------------
Try before you buy = See our experts in action!
The most comprehensive online learning library for Microsoft developers
is just $99.99! Visual Studio, SharePoint, SQL - plus HTML5, CSS3, MVC3,
Metro Style Apps, more. Free future releases when you subscribe now!
http://p.sf.net/sfu/learndevnow-dev2

_______________________________________________
Sguil-users mailing list
Sguil-users@...
https://lists.sourceforge.net/lists/listinfo/sguil-users

4	May 2012
5	April 2012
2	March 2012
25	February 2012
51	January 2012
6	December 2011
45	November 2011
55	October 2011
13	September 2011
10	August 2011
15	July 2011
9	June 2011
12	May 2011
24	April 2011
37	March 2011
7	February 2011
5	January 2011
3	December 2010
6	October 2010
7	September 2010
5	August 2010
1	July 2010
4	June 2010
8	May 2010
9	April 2010
30	March 2010
6	January 2010
40	December 2009
23	November 2009
16	October 2009
6	September 2009
17	August 2009
7	July 2009
1	June 2009
11	May 2009
18	April 2009
7	March 2009
14	January 2009
28	December 2008
21	November 2008
44	October 2008
29	September 2008
7	August 2008
60	July 2008
15	June 2008
29	May 2008
45	April 2008
22	March 2008
24	February 2008
14	January 2008
20	December 2007
32	November 2007
58	October 2007
20	September 2007
20	August 2007
15	July 2007
23	June 2007
48	May 2007
26	April 2007
49	March 2007
95	February 2007
42	January 2007
14	December 2006
30	November 2006
65	October 2006
34	September 2006
21	August 2006
12	July 2006
33	June 2006
24	May 2006
36	April 2006
115	March 2006
68	February 2006
52	January 2006
25	December 2005
27	November 2005
10	October 2005
43	September 2005
6	August 2005
29	July 2005
20	June 2005
7	May 2005
3	April 2005
81	March 2005
109	February 2005
113	January 2005
11	December 2004
14	November 2004
11	October 2004
10	September 2004
24	August 2004
12	July 2004
4	June 2004

Mon	Tue	Wed	Thu	Fri	Sat	Sun

	1	2	3	4	5	6
7	8	9	10	11	12	13
14	15	16	17	18	19	20
21	22	23	24	25	26	27
28	29	30	31