Hello, On 01/10/2011 10:24 PM, loyd. darby wrote:
Using snare creates a drop point for logging because it does not guarantee delivery (it just sends the messages and if they don't make it snare does not care). I think using the ossec agent for windows is a better choice for delivery.
Not from the reliability point-of-view. OSSEC also uses UDP so it has the same possibility for messages getting dropped and not resent as Snare does. There are work-a-rounds, though.
One big difference is that ossec will be
sending everything to the server and snare only sends the events selected in the registry. Neither does a good job correlating logon events since they are now fragmented. A single logon generates a ton of logon events if auditing is fully engaged. I also noticed that with the ossec windows agent there are important events that don't get flagged (like terminal server logins).
OSSEC has a pretty advanced correlation engine. If you think there are events that should have rules or better correlation logic, please let us know. I have written many of the Windows rules and it is definitely a work-in-progress. There are many improvements I would like to make in this area.
