Sguil 0.2.5 on Windows

Want to become an "F8 monkey?" My friend Bamm Visscher released sguil 0.2.5 yesterday. Sguil is an interface to the Snort intrusion detection engine. By combining Snort with other code, it brings Snort closer to being an implementation of "network security monitoring," and not simply "intrusion detection."


Bamm has made a demo Sguil server available. Here's a step-by-step guide to installing the Sguil client on Windows, so you can access the Sguil server at Bamm's office.


1. Download and install the latest version of ActiveTCL. Below you see I downloaded the ActiveTCL 8.4.3.0 Windows package. I installed it in "C:\Program Files\tcl".




2. Next, download the sguil-client-0.2.5.zip archive from Sourceforge:




3. Extract the contents of the .zip file. I extracted mine to "C:\Program Files\sguil". Once on your hard drive, edit the sguil.conf file located in the "C:\Program Files\sguil\sguil-0.2.5\client\" directory. Make the change as highlighted below to set your Sguil server to Bamm's office machine at bamm.dyndns.org:




4. Now you need to associated the sguil.tk Tcl application with the Tcl interpreter. This will allow you to double-click on the sguil.tk file in "C:\Program Files\sguil\sguil-0.2.5\client\" and launch the application. In the Windows Explorer, right-click on sguil.tk and select properties:




5. You will see a button which says "Change". This allows you to associate the sguil.tk file with a new application. The screen shot shows mine associated with WordPad. We want to change that, so find the associated title "Wish Application" and click "Ok" to associate .tk files with "Wish":




6. When you're done, sguil.tk will be associated with "Wish":




7. That's it! Double-click on "sguil.tk" in the "C:\Program Files\sguil\sguil-0.2.5\client\" directory and you will be prompted for a username and password. Enter the name by which you want to be identified and any password you want:




8. You will be prompted to choose a sensor. Click the 'reset' button (that's the sensor name) and then 'Start SGUIL'.




9. You should a screen like the one below appear. If so, you're using Sguil!




10. This sensor is not monitoring the external interface of the bamm.dyndns.org network, so if you portscan or otherwise attack bamm.dyndns.org, it will not register on the Sguil interface. You can investigate the test alerts, though. For example, you can run a query on the source IP of the entry highlighted below by right-clicking on it:




Here are the results:




11. If you want to chat with other people using Sguil, select the "User Messages" tab and enter messages in the MSG: field. To see who is in using Sguil, type 'who':




If you have questions, the Sguil authors hang out in #snort-gui on irc.freenode.net. Enjoy!

Popular posts from this blog

Zeek in Action Videos

Image
This is a quick note to point blog readers to my Zeek in Action YouTube video series for the Zeek network security monitoring project .  Each video addresses a topic that I think might be of interest to people trying to understand their network using Zeek and adjacent tools and approaches, like Suricata, Wireshark, and so on.  I am especially pleased with Video 6 on monitoring wireless networks . It took me several weeks to research material for this video. I had to buy new hardware and experiment with a Linux distro that I had not used before -- Parrot .  Please like and subscribe, and let me know if there is a topic you think might make a good video.
Read more

MITRE ATT&CK Tactics Are Not Tactics

Image
Just what are "tactics"? Introduction MITRE ATT&CK  is a great resource, but something about it has bothered me since I first heard about it several years ago. It's a minor point, but I wanted to document it in case it confuses anyone else. The MITRE ATT&CK Design and Philosophy document from March 2020 says the following: At a high-level, ATT&CK is a behavioral model that consists of the following core components: • Tactics, denoting short-term, tactical adversary goals during an attack; • Techniques, describing the means by which adversaries achieve tactical goals; • Sub-techniques, describing more specific means by which adversaries achieve tactical goals at a lower level than techniques; and • Documented adversary usage of techniques, their procedures, and other metadata. My concern is with MITRE's definition of "tactics" as "short-term, tactical adversary goals during an attack," which is oddly recursive. The key word in the tacti...
Read more

New Book! The Best of TaoSecurity Blog, Volume 4

Image
  I've completed the TaoSecurity Blog book series . The new book is  The Best of TaoSecurity Blog, Volume 4: Beyond the Blog with Articles, Testimony, and Scholarship .  It's available now for Kindle , and I'm working on the print edition.  I'm running a 50% off promo on Volumes 1-3 on Kindle through midnight 20 April. Take advantage before the prices go back up. I described the new title thus: Go beyond TaoSecurity Blog with this new volume from author Richard Bejtlich. In the first three volumes of the series, Mr. Bejtlich selected and republished the very best entries from 18 years of writing and over 18 million blog views, along with commentaries and additional material.  In this title, Mr. Bejtlich collects material that has not been published elsewhere, including articles that are no longer available or are stored in assorted digital or physical archives. Volume 4 offers early white papers that Mr. Bejtlich wrote as a network defender, either for technica...
Read more