Sourcefire Inc. on Wednesday will announce the second product in its lineup of tools based on the open-source Snort intrusion-detection system.
The OpenSnort Management Console appliance is designed to manage a network of Snort IDS sensors and was built with the needs of security administrators in mind, said Martin Roesch, president of Sourcefire, based in Columbia, Md., and the lead developer of Snort.
The console has a Web-based user interface through which administrators can access all of the real-time data from their Snort sensors, as well as manage and configure the devices. The console also enables users to store data for future reference and provides data-mining capabilities to help identify attack trends.
The consoles main view shows the number of alerts per sensor, the top 10 IP addresses from which attacks have originated, the top 10 destination IP addresses and the top 10 addresses for each sensor on the network. Each IP address is a hot link that enables the user to click through to progressively finer levels of detail. Five clicks takes the user to the individual packet level.
Administrators can also set up discreet groups of sensors, each with its own set of policies and logs.
The idea, Roesch says, was to develop something that was easy enough to use that people without deep IDS backgrounds would feel comfortable using the console.
“We wanted you to be able to control all aspects of the sensor from the Web UI,” he said. “You never have to touch a command line. We spent a lot of time working on the data-management and ease-of-use capabilities.”
To that end, the OpenSnort Management Console also gives users the ability write their own IDS signatures and customize the pre-installed ones.
The other half of the Sourcefire product line is the OpenSnort Sensor, a commercial version of the free IDS that Roesch and others developed in 1998. Snort has been one of the biggest success stories of the open-source movement, with as many as 10,000 downloads weekly.
Sourcefire is going after the large enterprise and service provider markets with its commercial products, and Roesch said that companies who only need one or two sensors are still better off with the free version.
The console, which is available immediately, sells for $20,000, and each additional OpenSnort sensor is $9,995.
