C

H A P T E R

6

Using ACID

and SnortSnarf

with Snort

nalysis Console for Intrusion Databases

 (ACID) is a tool used to

A

analyze and present Snort data using a web interface. It is written in

PHP. It works with Snort and databases like MySQL, as you have learned

in the last chapter, and makes information available in the database to the

user through a web server. In addition to Snort, the tool can be used with

other security related products like firewalls and networking monitoring.

This chapter provides information about ACID and discusses how to

install it with MySQL and Snort to view and analyze the intrusion detec 

tion data logged by Snort into the database. You will go through a step by 

step procedure  to install ACID and use it. The graphical representation of

captured data is very useful for analysis purposes.

In addition to ACID, the chapter also provides basic information about

SnortSnarf, another tool that can be used with a web server. SnortSnarf is

able to parse Snort log files and generate HTML pages that can be viewed

using a web browser. I assume that you are able to install and run Apache

web server as well as MySQL database server, which are required in order

to use the tools discussed in this chapter.

177