Wednesday, February 08, 2006

Integrating Sguil into Intrusion Detection and Incident Response

A fellow Sguil user wrote a surprisingly complete account of a compromise of his Web server, and how he used Sguil to identify the intrusion and respond to the incident. The author, Chas Tomlin, provides a step-by-step walkthrough of his investigation, along with some of his actual findings -- including a transcript of an IRC conversation between bot net operators.

3 comments:

Anonymous said...

It's really cool to see Sguil in action. I am in the process of setting up snort and sguil. I have been thinking about collecting full content data, and having it moved to a san or server with large capacity storage. I haven't seen any docs on doing this, so I am not sure on the feasibility of doing this. Any thoughts on this.

Thanks,

Roger Crane

Anonymous said...

I love how the IRC transcript shows the mentality of these idiots. Calling themselves "kernel experts" and arguing over who has the more "elite" method.

Anonymous said...

We do the same things in our locked server rooms. ;)

Anyway, love seeing these kinds of posts and hands-on case studies.

-LonerVamp