What do you use to track security incidents?

Any open source software that does this?

Hi,

What exactly do you mean by security incidents? Hacker attacks, unlawful access to your system, rootkits, ...? Have a look at these sites, the mention lots of software packages in regards to security on Linux systems.

http://en.wikipedia.org/wiki/Categor...urity_software
http://www.yolinux.com/TUTORIALS/Lin...rityTools.html

Kind regards,

Eric

I mean like a database driven CMS, so I can enter things like
server1 had a lot of port scans, no unauthorized access
server2 had a user level access breach, root was not breached

etc.

Good question. I recently found Verizon's VERIS Framework which includes useful security metrics that I believe they used to create their yearly incident reports. I've heard good reviews on IT Security Metrics, which I've just started reading. That might be of use to you. But I'm also interested in how other people keep track of security metrics.

1 members found this post helpful.

Hi,

There are lots of utilities out there that can help you protect access to your server(s). For example I have Squid set up as reverse proxy and to somehow control the access, port scans and break-in attempts I have Snort installed which does a great job. Logwatch and rkhunter are other tools that I install on any server to monitor any changes that might occur. Most of the tools I mention are used for intrusion detection and thus warn you after the fact. It might be worth, as I plan to do, to look into intrusion prevention systems/software.

One great starting point for references is this thread by LQ's own unSpawn (I haven't even read 25% of what's mentioned there).

Kind regards,

Eric

Sweet, thanks!

Yep, I'm looking for like a summary tool for the summaries of those though.

It has been a few years since I saw it in action, but Tipping Point was an interesting project when I got to see it. There were some security flaws back then but HP still seem to have the project running so I would hope they had gotten through them. It would monitor the traffic and generate its own reports.

HP Tipping Point Security
http://h10144.www1.hp.com/products/security/index.htm

Where I work (or rather, used to work), we used the same trouble ticket system that we relied on for everything else. You just needed to assign the proper category and severity to the ticket.