2015-12-06 13:13:12 +01:00
|
|
|
# $NetBSD: Makefile,v 1.37 2015/12/06 12:13:12 taca Exp $
|
The Basic Analysis and Security Engine (BASE) is a PHP-based analysis
engine to search and process a database of security events generated by
various IDSes, firewalls, and network monitoring tools. The features currently
include:
o Query-builder and search interface for finding alerts matching
on alert meta information (e.g. signature, detection time) as well as
the underlying network evidence (e.g. source/destination address, ports,
payload, or flags).
o Packet viewer (decoder) will graphically display the layer-3 and
layer-4 packet information of logged alerts
o Alert management by providing constructs to logically group alerts
to create incidents (alert groups), deleting the handled alerts or
false positives, exporting to email for collaboration, or archiving of
alerts to transfer them between alert databases.
o Chart and statistic generation based on time, sensor, signature, protocol,
IP address, TCP/UDP ports, or classification
2006-01-03 22:09:44 +01:00
|
|
|
#
|
|
|
|
|
|
4/03/2009 1.4.2 (chandy)
- EmThreats_link opens now in separate browser window -- Juergen Leising for Micah Gersten
- A new reference "[rule]" points now to base_local_rules.php,
which displays a particular rule for a given rules id (sid).
Prerequisite for this is that "local_rules_dir" in base_conf.php
points to an actually existing and readable/searchable directory which
contains the snort rules. Please note, that a web server
is usually NOT allowed to access any files outside of its
document root. Feature request by Chris Ryan, cf.
https://sourceforge.net/forum/message.php?msg_id=5310420
https://sourceforge.net/forum/message.php?msg_id=5311517
-- Juergen Leising
- Update of base.spec; works with fedora 10 -- Juergen Leising
- I have applied two patches submitted by asavenkov
with regard to the oci8 driver (oracle 10), cf.
https://sourceforge.net/forum/message.php?msg_id=5795641
https://sourceforge.net/forum/message.php?msg_id=5796556
-- Juergen Leising
- The "email-the-alerts"-variables were defined twice at different
locations in base_conf.php. Fixed this. -- Juergen Leising
- Emails from BASE containing one or more alerts include now a
"To:"-header, as well. Bug report no. 2234733 -- Juergen Leising
- $sort_order, once it has been chosen, survives now a possible "action",
even in base_stat_uaddr.php, base_stat_ports.php, base_stat_iplink.php,
base_stat_class.php and base_stat_sensor.php.
Bug no. 2234745. -- Juergen Leising
- The refresh-problem, when an "action" has been taken, is now fixed in
base_stat_uaddr.php, base_stat_ports.php, base_stat_iplink.php,
base_stat_class.php and base_stat_sensor.php, as well.
Bug no. 1681012. -- Juergen Leising
- I have corrected the way ICMP redirect messages are displayed
by BASE, inspired by Bruno G. San Alejo. -- Juergen Leising
- Several preprocessor events that did not get stored in the acid_event
table, so far, are now processed and displayed by BASE. This affects
all those preprocessors which have sig names that do NOT start with
a "spp_" prefix. -- Juergen Leising
- Fixed bug with archiving IP options. -- Juergen Leising
5/14/09 1.4.3 (gabi)
- XSS Flaws fixed in alert groups -- Kevin Johnson
- Possible SQL injection flaw fixed in AG -- Kevin Johnson
- XSS Flaws fixed in base_qry files -- Kevin Johnson
- Multiple XSS flaws fixed in citems -- Kevin Johnson
5/30/09 1.4.3.1 (zig)
- Multiple XSS flaws fixed in User and Role management -- Kevin Johnson
2009-06-06 13:26:19 +02:00
|
|
|
DISTNAME= base-1.4.3.1
|
2015-06-12 12:50:58 +02:00
|
|
|
PKGREVISION= 9
|
The Basic Analysis and Security Engine (BASE) is a PHP-based analysis
engine to search and process a database of security events generated by
various IDSes, firewalls, and network monitoring tools. The features currently
include:
o Query-builder and search interface for finding alerts matching
on alert meta information (e.g. signature, detection time) as well as
the underlying network evidence (e.g. source/destination address, ports,
payload, or flags).
o Packet viewer (decoder) will graphically display the layer-3 and
layer-4 packet information of logged alerts
o Alert management by providing constructs to logically group alerts
to create incidents (alert groups), deleting the handled alerts or
false positives, exporting to email for collaboration, or archiving of
alerts to transfer them between alert databases.
o Chart and statistic generation based on time, sensor, signature, protocol,
IP address, TCP/UDP ports, or classification
2006-01-03 22:09:44 +01:00
|
|
|
CATEGORIES= security
|
|
|
|
|
MASTER_SITES= ${MASTER_SITE_SOURCEFORGE:=secureideas/}
|
|
|
|
|
|
2009-07-17 20:00:13 +02:00
|
|
|
MAINTAINER= pkgsrc-users@NetBSD.org
|
2006-05-13 00:31:38 +02:00
|
|
|
HOMEPAGE= http://secureideas.sourceforge.net/
|
The Basic Analysis and Security Engine (BASE) is a PHP-based analysis
engine to search and process a database of security events generated by
various IDSes, firewalls, and network monitoring tools. The features currently
include:
o Query-builder and search interface for finding alerts matching
on alert meta information (e.g. signature, detection time) as well as
the underlying network evidence (e.g. source/destination address, ports,
payload, or flags).
o Packet viewer (decoder) will graphically display the layer-3 and
layer-4 packet information of logged alerts
o Alert management by providing constructs to logically group alerts
to create incidents (alert groups), deleting the handled alerts or
false positives, exporting to email for collaboration, or archiving of
alerts to transfer them between alert databases.
o Chart and statistic generation based on time, sensor, signature, protocol,
IP address, TCP/UDP ports, or classification
2006-01-03 22:09:44 +01:00
|
|
|
COMMENT= Analysis engine to process a database of security events
|
|
|
|
|
|
2008-06-20 03:09:05 +02:00
|
|
|
PKG_DESTDIR_SUPPORT= destdir
|
|
|
|
|
|
2012-04-14 18:25:11 +02:00
|
|
|
.include "../../mk/apache.mk"
|
2007-11-25 19:09:53 +01:00
|
|
|
.include "../../lang/php/phpversion.mk"
|
2007-06-30 15:47:38 +02:00
|
|
|
|
2007-11-25 19:09:53 +01:00
|
|
|
DEPENDS+= adodb>=4.96a:../../databases/adodb
|
2006-06-02 20:27:54 +02:00
|
|
|
DEPENDS+= ${PHP_PKG_PREFIX}-gd>=4.0.4:../../graphics/php-gd
|
|
|
|
|
DEPENDS+= ${PHP_PKG_PREFIX}-sockets>=4.0.4:../../net/php-sockets
|
|
|
|
|
DEPENDS+= ${PHP_PKG_PREFIX}-mysql>=4.0.4:../../databases/php-mysql
|
|
|
|
|
DEPENDS+= ${PHP_PKG_PREFIX}-pear-Log-[0-9]*:../../sysutils/pear-Log
|
|
|
|
|
DEPENDS+= ${PHP_PKG_PREFIX}-pear-Numbers_Words-[0-9]*:../../math/pear-Numbers_Words
|
|
|
|
|
DEPENDS+= ${PHP_PKG_PREFIX}-pear-Numbers_Roman-[0-9]*:../../math/pear-Numbers_Roman
|
|
|
|
|
DEPENDS+= ${PHP_PKG_PREFIX}-pear-Image_Color-[0-9]*:../../graphics/pear-Image_Color
|
|
|
|
|
DEPENDS+= ${PHP_PKG_PREFIX}-pear-Image_Graph-[0-9]*:../../graphics/pear-Image_Graph
|
2008-12-07 23:38:13 +01:00
|
|
|
DEPENDS+= ${PHP_PKG_PREFIX}-pear-Mail-[0-9]*:../../mail/pear-Mail
|
2008-12-07 23:41:25 +01:00
|
|
|
DEPENDS+= ${PHP_PKG_PREFIX}-pear-Mail_Mime-[0-9]*:../../mail/pear-Mail_Mime
|
2007-11-25 19:09:53 +01:00
|
|
|
DEPENDS+= ${APACHE_PKG_PREFIX}-${PHP_PKG_PREFIX}>=4.0.4:../../www/ap-php
|
The Basic Analysis and Security Engine (BASE) is a PHP-based analysis
engine to search and process a database of security events generated by
various IDSes, firewalls, and network monitoring tools. The features currently
include:
o Query-builder and search interface for finding alerts matching
on alert meta information (e.g. signature, detection time) as well as
the underlying network evidence (e.g. source/destination address, ports,
payload, or flags).
o Packet viewer (decoder) will graphically display the layer-3 and
layer-4 packet information of logged alerts
o Alert management by providing constructs to logically group alerts
to create incidents (alert groups), deleting the handled alerts or
false positives, exporting to email for collaboration, or archiving of
alerts to transfer them between alert databases.
o Chart and statistic generation based on time, sensor, signature, protocol,
IP address, TCP/UDP ports, or classification
2006-01-03 22:09:44 +01:00
|
|
|
|
2015-12-06 13:13:12 +01:00
|
|
|
PHP_VERSIONS_ACCEPTED= 55 56
|
|
|
|
|
|
The Basic Analysis and Security Engine (BASE) is a PHP-based analysis
engine to search and process a database of security events generated by
various IDSes, firewalls, and network monitoring tools. The features currently
include:
o Query-builder and search interface for finding alerts matching
on alert meta information (e.g. signature, detection time) as well as
the underlying network evidence (e.g. source/destination address, ports,
payload, or flags).
o Packet viewer (decoder) will graphically display the layer-3 and
layer-4 packet information of logged alerts
o Alert management by providing constructs to logically group alerts
to create incidents (alert groups), deleting the handled alerts or
false positives, exporting to email for collaboration, or archiving of
alerts to transfer them between alert databases.
o Chart and statistic generation based on time, sensor, signature, protocol,
IP address, TCP/UDP ports, or classification
2006-01-03 22:09:44 +01:00
|
|
|
NO_BUILD= YES
|
4/03/2009 1.4.2 (chandy)
- EmThreats_link opens now in separate browser window -- Juergen Leising for Micah Gersten
- A new reference "[rule]" points now to base_local_rules.php,
which displays a particular rule for a given rules id (sid).
Prerequisite for this is that "local_rules_dir" in base_conf.php
points to an actually existing and readable/searchable directory which
contains the snort rules. Please note, that a web server
is usually NOT allowed to access any files outside of its
document root. Feature request by Chris Ryan, cf.
https://sourceforge.net/forum/message.php?msg_id=5310420
https://sourceforge.net/forum/message.php?msg_id=5311517
-- Juergen Leising
- Update of base.spec; works with fedora 10 -- Juergen Leising
- I have applied two patches submitted by asavenkov
with regard to the oci8 driver (oracle 10), cf.
https://sourceforge.net/forum/message.php?msg_id=5795641
https://sourceforge.net/forum/message.php?msg_id=5796556
-- Juergen Leising
- The "email-the-alerts"-variables were defined twice at different
locations in base_conf.php. Fixed this. -- Juergen Leising
- Emails from BASE containing one or more alerts include now a
"To:"-header, as well. Bug report no. 2234733 -- Juergen Leising
- $sort_order, once it has been chosen, survives now a possible "action",
even in base_stat_uaddr.php, base_stat_ports.php, base_stat_iplink.php,
base_stat_class.php and base_stat_sensor.php.
Bug no. 2234745. -- Juergen Leising
- The refresh-problem, when an "action" has been taken, is now fixed in
base_stat_uaddr.php, base_stat_ports.php, base_stat_iplink.php,
base_stat_class.php and base_stat_sensor.php, as well.
Bug no. 1681012. -- Juergen Leising
- I have corrected the way ICMP redirect messages are displayed
by BASE, inspired by Bruno G. San Alejo. -- Juergen Leising
- Several preprocessor events that did not get stored in the acid_event
table, so far, are now processed and displayed by BASE. This affects
all those preprocessors which have sig names that do NOT start with
a "spp_" prefix. -- Juergen Leising
- Fixed bug with archiving IP options. -- Juergen Leising
5/14/09 1.4.3 (gabi)
- XSS Flaws fixed in alert groups -- Kevin Johnson
- Possible SQL injection flaw fixed in AG -- Kevin Johnson
- XSS Flaws fixed in base_qry files -- Kevin Johnson
- Multiple XSS flaws fixed in citems -- Kevin Johnson
5/30/09 1.4.3.1 (zig)
- Multiple XSS flaws fixed in User and Role management -- Kevin Johnson
2009-06-06 13:26:19 +02:00
|
|
|
#WRKSRC= ${WRKDIR}/base-php4
|
The Basic Analysis and Security Engine (BASE) is a PHP-based analysis
engine to search and process a database of security events generated by
various IDSes, firewalls, and network monitoring tools. The features currently
include:
o Query-builder and search interface for finding alerts matching
on alert meta information (e.g. signature, detection time) as well as
the underlying network evidence (e.g. source/destination address, ports,
payload, or flags).
o Packet viewer (decoder) will graphically display the layer-3 and
layer-4 packet information of logged alerts
o Alert management by providing constructs to logically group alerts
to create incidents (alert groups), deleting the handled alerts or
false positives, exporting to email for collaboration, or archiving of
alerts to transfer them between alert databases.
o Chart and statistic generation based on time, sensor, signature, protocol,
IP address, TCP/UDP ports, or classification
2006-01-03 22:09:44 +01:00
|
|
|
|
2006-05-13 00:31:38 +02:00
|
|
|
.include "../../mk/bsd.prefs.mk"
|
|
|
|
|
|
2008-11-05 23:47:13 +01:00
|
|
|
DOC_FILES= CHANGELOG CREDITS README README.mssql TODO \
|
2008-11-05 23:50:00 +01:00
|
|
|
UPGRADE base_faq.rtf INSTALL INSTALL.rtf \
|
|
|
|
|
README.country_support README.graph_alert_data
|
2008-11-05 23:47:13 +01:00
|
|
|
BASE_DIR= ${PREFIX}/share/base
|
|
|
|
|
EGDIR= ${PREFIX}/share/examples/base
|
|
|
|
|
MESSAGE_SUBST+= EGDIR=${EGDIR:Q} BASE_DIR=${BASE_DIR:Q}
|
|
|
|
|
PAX_DIRS= admin help images includes languages scripts setup \
|
|
|
|
|
sql styles
|
|
|
|
|
WWW_USER?= ${APACHE_USER}
|
|
|
|
|
WWW_GROUP?= ${APACHE_GROUP}
|
|
|
|
|
USE_TOOLS+= pax perl:run
|
|
|
|
|
REPLACE_PERL+= scripts/base_maintenance.pl
|
2007-10-21 01:22:08 +02:00
|
|
|
|
2007-07-04 22:54:31 +02:00
|
|
|
PKG_GROUPS_VARS+= WWW_GROUP
|
|
|
|
|
PKG_USERS_VARS+= WWW_USER
|
|
|
|
|
|
2008-11-05 23:47:13 +01:00
|
|
|
CONF_FILES= ${EGDIR}/base.conf ${PKG_SYSCONFDIR}/base.conf
|
The Basic Analysis and Security Engine (BASE) is a PHP-based analysis
engine to search and process a database of security events generated by
various IDSes, firewalls, and network monitoring tools. The features currently
include:
o Query-builder and search interface for finding alerts matching
on alert meta information (e.g. signature, detection time) as well as
the underlying network evidence (e.g. source/destination address, ports,
payload, or flags).
o Packet viewer (decoder) will graphically display the layer-3 and
layer-4 packet information of logged alerts
o Alert management by providing constructs to logically group alerts
to create incidents (alert groups), deleting the handled alerts or
false positives, exporting to email for collaboration, or archiving of
alerts to transfer them between alert databases.
o Chart and statistic generation based on time, sensor, signature, protocol,
IP address, TCP/UDP ports, or classification
2006-01-03 22:09:44 +01:00
|
|
|
|
|
|
|
|
CONF_FILES_PERMS= ${EGDIR}/base_conf.php ${BASE_DIR}/base_conf.php \
|
|
|
|
|
${WWW_USER} ${WWW_GROUP} 0600
|
|
|
|
|
|
2007-11-25 19:09:53 +01:00
|
|
|
BUILD_DEFS+= APACHE_USER APACHE_GROUP
|
|
|
|
|
|
The Basic Analysis and Security Engine (BASE) is a PHP-based analysis
engine to search and process a database of security events generated by
various IDSes, firewalls, and network monitoring tools. The features currently
include:
o Query-builder and search interface for finding alerts matching
on alert meta information (e.g. signature, detection time) as well as
the underlying network evidence (e.g. source/destination address, ports,
payload, or flags).
o Packet viewer (decoder) will graphically display the layer-3 and
layer-4 packet information of logged alerts
o Alert management by providing constructs to logically group alerts
to create incidents (alert groups), deleting the handled alerts or
false positives, exporting to email for collaboration, or archiving of
alerts to transfer them between alert databases.
o Chart and statistic generation based on time, sensor, signature, protocol,
IP address, TCP/UDP ports, or classification
2006-01-03 22:09:44 +01:00
|
|
|
SUBST_CLASSES+= conf
|
|
|
|
|
SUBST_STAGE.conf= post-patch
|
|
|
|
|
SUBST_FILES.conf= base.conf base_conf.php.dist
|
2006-03-13 13:25:29 +01:00
|
|
|
SUBST_SED.conf= -e "s|@BASE_DIR@|${BASE_DIR}|g"
|
|
|
|
|
SUBST_SED.conf+= -e "s|@DBTYPE@|${DBTYPE}|g"
|
|
|
|
|
SUBST_SED.conf+= -e "s|@PREFIX@|${PREFIX}|g"
|
|
|
|
|
SUBST_MESSAGE.conf= Fixing configuration files.
|
The Basic Analysis and Security Engine (BASE) is a PHP-based analysis
engine to search and process a database of security events generated by
various IDSes, firewalls, and network monitoring tools. The features currently
include:
o Query-builder and search interface for finding alerts matching
on alert meta information (e.g. signature, detection time) as well as
the underlying network evidence (e.g. source/destination address, ports,
payload, or flags).
o Packet viewer (decoder) will graphically display the layer-3 and
layer-4 packet information of logged alerts
o Alert management by providing constructs to logically group alerts
to create incidents (alert groups), deleting the handled alerts or
false positives, exporting to email for collaboration, or archiving of
alerts to transfer them between alert databases.
o Chart and statistic generation based on time, sensor, signature, protocol,
IP address, TCP/UDP ports, or classification
2006-01-03 22:09:44 +01:00
|
|
|
|
2008-06-20 03:09:05 +02:00
|
|
|
INSTALLATION_DIRS= ${BASE_DIR} ${EGDIR} share/doc/base
|
|
|
|
|
|
The Basic Analysis and Security Engine (BASE) is a PHP-based analysis
engine to search and process a database of security events generated by
various IDSes, firewalls, and network monitoring tools. The features currently
include:
o Query-builder and search interface for finding alerts matching
on alert meta information (e.g. signature, detection time) as well as
the underlying network evidence (e.g. source/destination address, ports,
payload, or flags).
o Packet viewer (decoder) will graphically display the layer-3 and
layer-4 packet information of logged alerts
o Alert management by providing constructs to logically group alerts
to create incidents (alert groups), deleting the handled alerts or
false positives, exporting to email for collaboration, or archiving of
alerts to transfer them between alert databases.
o Chart and statistic generation based on time, sensor, signature, protocol,
IP address, TCP/UDP ports, or classification
2006-01-03 22:09:44 +01:00
|
|
|
.include "options.mk"
|
|
|
|
|
|
|
|
|
|
post-extract:
|
2006-10-23 20:19:45 +02:00
|
|
|
${CP} ${FILESDIR}/base.conf ${WRKSRC}/base.conf
|
2007-05-19 01:27:22 +02:00
|
|
|
${FIND} ${WRKSRC} -name *.php | ${XARGS} ${CHMOD} ${SHAREMODE}
|
The Basic Analysis and Security Engine (BASE) is a PHP-based analysis
engine to search and process a database of security events generated by
various IDSes, firewalls, and network monitoring tools. The features currently
include:
o Query-builder and search interface for finding alerts matching
on alert meta information (e.g. signature, detection time) as well as
the underlying network evidence (e.g. source/destination address, ports,
payload, or flags).
o Packet viewer (decoder) will graphically display the layer-3 and
layer-4 packet information of logged alerts
o Alert management by providing constructs to logically group alerts
to create incidents (alert groups), deleting the handled alerts or
false positives, exporting to email for collaboration, or archiving of
alerts to transfer them between alert databases.
o Chart and statistic generation based on time, sensor, signature, protocol,
IP address, TCP/UDP ports, or classification
2006-01-03 22:09:44 +01:00
|
|
|
|
|
|
|
|
do-install:
|
2008-06-20 03:09:05 +02:00
|
|
|
${INSTALL_DATA} ${WRKSRC}/base.conf ${DESTDIR}${EGDIR}
|
|
|
|
|
${INSTALL_DATA} ${WRKSRC}/base_conf.php.dist ${DESTDIR}${EGDIR}/base_conf.php
|
|
|
|
|
${INSTALL_DATA} ${WRKSRC}/*.php ${DESTDIR}${BASE_DIR}
|
The Basic Analysis and Security Engine (BASE) is a PHP-based analysis
engine to search and process a database of security events generated by
various IDSes, firewalls, and network monitoring tools. The features currently
include:
o Query-builder and search interface for finding alerts matching
on alert meta information (e.g. signature, detection time) as well as
the underlying network evidence (e.g. source/destination address, ports,
payload, or flags).
o Packet viewer (decoder) will graphically display the layer-3 and
layer-4 packet information of logged alerts
o Alert management by providing constructs to logically group alerts
to create incidents (alert groups), deleting the handled alerts or
false positives, exporting to email for collaboration, or archiving of
alerts to transfer them between alert databases.
o Chart and statistic generation based on time, sensor, signature, protocol,
IP address, TCP/UDP ports, or classification
2006-01-03 22:09:44 +01:00
|
|
|
|
|
|
|
|
. for f in ${DOC_FILES}
|
2008-06-20 03:09:05 +02:00
|
|
|
${INSTALL_DATA} ${WRKSRC}/docs/${f:Q} ${DESTDIR}${PREFIX}/share/doc/base
|
The Basic Analysis and Security Engine (BASE) is a PHP-based analysis
engine to search and process a database of security events generated by
various IDSes, firewalls, and network monitoring tools. The features currently
include:
o Query-builder and search interface for finding alerts matching
on alert meta information (e.g. signature, detection time) as well as
the underlying network evidence (e.g. source/destination address, ports,
payload, or flags).
o Packet viewer (decoder) will graphically display the layer-3 and
layer-4 packet information of logged alerts
o Alert management by providing constructs to logically group alerts
to create incidents (alert groups), deleting the handled alerts or
false positives, exporting to email for collaboration, or archiving of
alerts to transfer them between alert databases.
o Chart and statistic generation based on time, sensor, signature, protocol,
IP address, TCP/UDP ports, or classification
2006-01-03 22:09:44 +01:00
|
|
|
. endfor
|
|
|
|
|
|
|
|
|
|
. for i in ${PAX_DIRS}
|
2013-10-18 13:41:17 +02:00
|
|
|
${INSTALL_DATA_DIR} ${DESTDIR}${BASE_DIR}/${i:Q}
|
2008-06-20 03:09:05 +02:00
|
|
|
cd ${WRKSRC}/${i:Q} && pax -rw . ${DESTDIR}${BASE_DIR}/${i:Q}
|
The Basic Analysis and Security Engine (BASE) is a PHP-based analysis
engine to search and process a database of security events generated by
various IDSes, firewalls, and network monitoring tools. The features currently
include:
o Query-builder and search interface for finding alerts matching
on alert meta information (e.g. signature, detection time) as well as
the underlying network evidence (e.g. source/destination address, ports,
payload, or flags).
o Packet viewer (decoder) will graphically display the layer-3 and
layer-4 packet information of logged alerts
o Alert management by providing constructs to logically group alerts
to create incidents (alert groups), deleting the handled alerts or
false positives, exporting to email for collaboration, or archiving of
alerts to transfer them between alert databases.
o Chart and statistic generation based on time, sensor, signature, protocol,
IP address, TCP/UDP ports, or classification
2006-01-03 22:09:44 +01:00
|
|
|
. endfor
|
|
|
|
|
|
2008-06-20 03:09:05 +02:00
|
|
|
${CHOWN} ${WWW_USER} ${DESTDIR}${BASE_DIR}
|
The Basic Analysis and Security Engine (BASE) is a PHP-based analysis
engine to search and process a database of security events generated by
various IDSes, firewalls, and network monitoring tools. The features currently
include:
o Query-builder and search interface for finding alerts matching
on alert meta information (e.g. signature, detection time) as well as
the underlying network evidence (e.g. source/destination address, ports,
payload, or flags).
o Packet viewer (decoder) will graphically display the layer-3 and
layer-4 packet information of logged alerts
o Alert management by providing constructs to logically group alerts
to create incidents (alert groups), deleting the handled alerts or
false positives, exporting to email for collaboration, or archiving of
alerts to transfer them between alert databases.
o Chart and statistic generation based on time, sensor, signature, protocol,
IP address, TCP/UDP ports, or classification
2006-01-03 22:09:44 +01:00
|
|
|
|
|
|
|
|
.include "../../mk/bsd.pkg.mk"
|
