SNORT plugin coming?

Subscribe to SNORT plugin coming? 2 post(s), 2 voice(s)

 
Avatar Virginian 2 post(s)

PCI compliance has as one of its requirements as a notification of security breach attempts from an IDS/IPS, not just logging.
Scout seems to be an ideal platform to integrate something like a SNORT plugin for this purpose.
High dollar solutions are available from alertlogic.com and others; however, a solution based on Scout and SNORT seems like it could fill a gap.

Any plans to do such in the near future?

 
Avatar Charles Bria... Administrator 16 post(s)

That is a most excellent suggestion. It seems like it would be very easy,—since Scout is simply Ruby, one could just parse the log file and grab what they wanted!

Check out our Rails Request plugin for details on how we implemented a simple log parser that reads the log from the end for a low memory footprint, and quick, detailed reads:

Rails Requests Plugin