snort reactor

We have hosted the application snort reactor in order to run this application in our online workstations with Wine or directly.

Quick description about snort reactor:

A package of scripts to watch for snort alerts, change / create firewall rules to block high priority alerts, and record recent blocks. It will increase block times based on previously recorded blocks.

Features:

• Perl script
• Manages IPTABLES blocks based on priority 2 or higher Snort alerts
• Can be triggered by specially marked Snort custom messages, reversing source & target for blocking purposes
• Maintains an SQL database of recent attacks by address & increases block times based on number of attacks seen

Audience: Information Technology, Advanced End Users, System Administrators.
User interface: Command-line.
Programming Language: Perl.
Database Environment: SQLite.

Categories: