Can anyone recommend a good IDS for Linux ?

Pauly · 02-26-2002, 01:12 PM

Can anyone tell me a good IDS that includes email notification
for Redhat 6.2 (2.2.20) ?? Or for that matter, can snort be configured to send email notifications?

I have already looked at demarc, but found the install to be as brutal as a oracle install.

unSpawn · 02-26-2002, 04:21 PM

I would think so, Snort comes with scripts processing the logs, just run 'em tru cron at the interval of your choice, else if any of the apps in the tarball's /contrib use snort's compile time switch "--with-flexresp", adding a (script)hack to add mail notification wouldn't be that hard me thinks. One thing you gotta be aware of is definately *not* opening up your email addy to DoSsing yourself with alerts :-]