Daemonlogger

Daemonlogger™ is a packet logger and soft tap developed by Martin Roesch. The libpcap-based program has two runtime modes:

1. It sniffs packets and spools them straight to the disk and can daemonize itself for background packet logging. By default the file rolls over when 2 GB of data is logged.


2. It sniffs packets and rewrites them to a second interface, essentially acting as a soft tap. It can also do this in daemon mode.

These two runtime modes are mutually exclusive, if the program is placed in tap mode (using the -I switch) then logging to disk is disabled.

Make SURE you read the included COPYING file so that you understand how this file is licensed by Cisco, even though it's under the GPL v2 there are some clarifications that we have made regarding the licensing of this program.

PE Sig is a tool written in Ruby that generates ClamAV® signatures for portable executable files.

Project Razorback™ is an undertaking by Talos. Razorback is a framework for an intelligence driven security solution. It consists of a Dispatcher at the core of the system, surrounded by Nuggets of varying types.

Pulled Pork

Pulled_Pork is tool written in perl for managing Snort rule sets. Pulled_Pork features include:

• Automatic rule downloads using your Oinkcode


• MD5 verification prior to downloading new rulesets


• Full handling of Shared Object (SO) rules


• Generation of so_rule stub files


• Modification of ruleset state (disabling rules, etc)


• The project is run by JJ Cummings

ThePigDoktah

Barnyard2 provides the following enhancements to the original

• Parsing of the new unified2 log files.


• Maintains majority of the command syntax of barnyard.


• Addressed all associated bug reports and feature requests arising since barnyard-0.2.0.


• Completely rewritten code based on the GPLv2 Snort making it entirely GPLv2.


• SnortSam functionality

Security Onion

Security Onion is a Linux distro for intrusion detection, network security monitoring, and log management. It's based on Ubuntu and contains Snort, Suricata, Bro, OSSEC, Sguil, Squert, Snorby, ELSA, Xplico, NetworkMiner, and many other security tools. The easy-to-use Setup wizard allows you to build an army of distributed sensors for your enterprise in minutes! For more information, or to contact the author, please see http://securityonion.net .

Sguil (pronounced sgweel) is built by network security analysts for network security analysts. Sguil's main component is an intuitive GUI that provides access to real time events, session data, and raw packet captures. Sguil facilitates the practice of Network Security Monitoring and event driven analysis. The Sguil client is written in tcl/tk and can be run on any operating system that supports tcl/tk (including Linux, *BSD, Solaris, MacOS, and Win32).

This tool is a small Linux Daemon that greps the Snort Alert file and blocks the offending hosts via iptables for a given amount of time. iBlock supports the whitelisting of IP addresses so those IPs will never be blocked.

PmGraph for Performance Monitor