When your network is being attacked, you need all the information you can in order to protect yourself. IDS/IPS (Intrusion Detection/Intrusion Prevention Systems), like "Snort" are great. However, you might only be seeing half of the picture. Today, almost every device you put on your network has the ability to "log" (syslog/snmp-traps) information. This means that during an attack, you will have thousands, if not hundreds of thousands of logs that might contain information about the attack. If you're not actively monitoring these logs, you’re missing a lot of potential attack data. Even if you are monitoring your logs, there is the chance of misconfiguration or lack of personnel necessary for 24/7 monitoring.
This is where Sagan can help you! Sagan can alert you when events are occurring in your syslogs that need your attention right away, in real time!
Sagan is a multi-threaded, real time system- and event-log monitoring system, but with a twist. Sagan uses a "Snort" like rule set for detecting "bad things" happening on your network and/or computer systems. If Sagan detects a "bad thing" happening, that event can be stored to a Snort database (MySQL/PostgreSQL) and Sagan will correlate the event with your Snort Intrusion Detection/Intrusion Prevention (IDS/IPS) system. Sagan is meant to be used in a 'centralized' logging environment, but will work fine as part of a standalone Host IDS system for workstations.
Sagan is fast: Sagan is written in C and is a multi-threaded application. Sagan is threaded to prevent blocking Input/Output (I/O). For example, data processing doesn't stop when an SQL query is needed. It is also meant to be as efficient as possible in terms of memory and CPU usage.
Sagan uses a "Snort" like rule set: If you're a user of "Snort" and understand Snort rule sets, then you already understand Sagan rule sets. Essentially, Sagan is compatible with Snort rule management utilities, like "oinkmaster" for example.
Sagan can log to Snort databases: Sagan will operate as a separate "sensor" ID to a Snort database. This means that your IDS/IPS events from Snort will remain separate from your Sagan (syslog/event log) events. Since Sagan can utilize Snort databases, using Snort front-ends like BASE and Snorby will not only work with your IDS/IPS event, but also with your syslog events as well!
Sagan output formats: You don't have to be a Snort user to use Sagan. Sagan supports multiple output formats, such as a standard output file log format (similar to Snort), e-mailing of alerts (via libesmtp), Logzilla support and externally based programs that you can develop using the language you prefer (Perl/Python/C/etc).You can download Sagan here
. The below video is a presentation given by Champ Clark III (AKA - Da Beave)
, the creator of Sagan for the Northeast Florida ISSA about Sagan. The presentation is essentially about the ideas and methodologies behind "Sagan", and future development plans.