The goal of this project was to build a Snort Intrusion Detection System (IDS) to monitor sections of an university department.  The initial parameters for the project were for the server to be built in a virtual environment, for the server to have MySQL database on the back end which would be populated with alerts, and then easily queried.  The virtual machine was created to run Ubuntu Server 10.04 LTS. A MySQL database was created which Barnyard2 populated when SNORT flagged a packet to trigger an alert.  SnortReport was also installed to provide a GUI interface for interacting with the database as well as provide preset queries.  After the student finished these steps, the parameters of the project were changed to include email and SMS message alters when snort triggers critical alerts. The student came across several solutions for these requirements finding Snort Alert Monitoring and a combination of sendmail and syslog-ng.  Time did not allow the student to fill these last few requirement changes.

 Project Student: Eric Mikeworth

Author