http://permalink.gmane.org/gmane.comp.security.sguil.general hourly 1 1901-01-01T00:00+00:00 http://gmane.org/img/gmane-25t.png http://gmane.org http://permalink.gmane.org/gmane.comp.security.sguil.general/2424 <pre>We're in the process of migrating to SGUIL 0.8.x and we're running into an issue where Sancp presents a date that has passed under the "Last" column in the Agent Status tab. Do I have to recompile Sancp in a specific manner or is there another solution to that issue? ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/_______________________________________________ Sguil-users mailing list Sguil-users-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f&lt; at &gt;public.gmane.org https://lists.sourceforge.net/lists/listinfo/sguil-users </pre> Rene Borges 2012-05-22T17:48:05 http://permalink.gmane.org/gmane.comp.security.sguil.general/2423 <pre>sguil-users-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f&lt; at &gt;public.gmane.org group visibly, how? newest. became to receive now (Client). (Event Group an single Event)? Also check your autocategorize as well :) James ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ </pre> Lay, James 2012-05-07T22:52:34 http://permalink.gmane.org/gmane.comp.security.sguil.general/2422 <pre>New events matching the same source and signature are aggregated together. To view all the aggregated events, right click on the CNT (count) column and select "view correlated events". To guarantee only the newest events are shown in the realtime console, categorize analyzed events. This will update their status in the DB, but remove them from the realtime panes. New alerts will repopulate the main screen. You can always view the old alerts with a simple query. Bamm On Wed, May 2, 2012 at 1:15 PM, Stefan Sabolowitsch &lt;Stefan.Sabolowitsch-LK+KGM74Etl+l3BRcVcdTQ&lt; at &gt;public.gmane.org&gt; wrote: </pre> Bamm Visscher 2012-05-07T20:50:20 http://permalink.gmane.org/gmane.comp.security.sguil.general/2421 <pre>Hi Bamm, all Bamm i see in the event Group "only" the first Event and not the newest. Thus it is to be found with difficulty out, which current event became to receive now (Client). How can i guarantee that the most current events are visible always (Event Group an single Event)? Thanks for your time and help. Stefan ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ </pre> Stefan Sabolowitsch 2012-05-02T17:15:18 http://permalink.gmane.org/gmane.comp.security.sguil.general/2420 <pre>As a follow-up, I found a bug in tcpflow 1.2.4 and Simson fixed it in tcpflow 1.2.6 released last night. I just packaged it and released it to all Security Onion users: http://securityonion.blogspot.com/2012/04/security-onion-20120418-now-available.html This update installs the new tcpflow 1.2.6 at /usr/local/bin/tcpflow and a shim at /usr/bin/tcpflow. The shim is just a bash script that runs the following: /usr/local/bin/tcpflow -T%A.%a-%B.%b $&lt; at &gt; The new version of tcpflow has a new output format so we execute the shim to call tcpflow with the correct -T options to produce the original tcpflow format that Sguil is expecting. Hope that helps! Thanks, Doug On Wed, Apr 4, 2012 at 6:23 PM, Doug Burks &lt;doug.burks-Re5JQEeQqe8AvxtiuMwx3w&lt; at &gt;public.gmane.org&gt; wrote: </pre> Doug Burks 2012-04-20T13:56:27 http://permalink.gmane.org/gmane.comp.security.sguil.general/2419 <pre>I haven't looked at the 1.2.3 source, but could you comment out that entire code block you mentioned? Alternatively, could you have Sguil call a bash script that would in turn call tcpflow using the proper vlan options and passing on the options received from Sguil? Thanks, Doug On Wednesday, April 4, 2012, Jeremy Hoel wrote: </pre> Doug Burks 2012-04-04T22:23:01 http://permalink.gmane.org/gmane.comp.security.sguil.general/2418 <pre>Check that out.. So looking at your post.. that's different from the flow.cpp that I'm seeing in the 1.2.3 build. I See: case 'V': // '--' if VLAN is present if(vlan!=NO_VLAN) ss &lt;&lt; "--"; break; case 'v': // VLAN number if VLAN is present if(vlan!=NO_VLAN) ss &lt;&lt; vlan; break; I assume that we should try and use the 'v' option but the sguild.conf doesn't really lend itself to supporting switches. On Wed, Apr 4, 2012 at 8:59 PM, Doug Burks &lt;doug.burks-Re5JQEeQqe8AvxtiuMwx3w&lt; at &gt;public.gmane.org&gt; wrote: ------------------------------------------------------------------------------ Better than sec? Nothing is better than sec when it comes to monitoring Big Data applications. Try Boundary one-second resolution app monitoring today. Free. http://p.sf.net/sfu/Boundary-dev2dev </pre> Jeremy Hoel 2012-04-04T21:29:42 http://permalink.gmane.org/gmane.comp.security.sguil.general/2417 <pre>Hi Jeremy, Simson added VLAN support to tcpflow in 1.1.1 and it appends the VLAN tag to the SRC and DST lines. I believe he made it a configurable option, but I just commented out the code in flow.cpp that outputs the VLAN tags and it works fine for me and the rest of my users. For more information, please see: http://code.google.com/p/security-onion/issues/detail?id=148 Hope that helps! Thanks, Doug On Wed, Apr 4, 2012 at 4:45 PM, Jeremy Hoel &lt;jthoel-Re5JQEeQqe8AvxtiuMwx3w&lt; at &gt;public.gmane.org&gt; wrote: </pre> Doug Burks 2012-04-04T20:59:25 http://permalink.gmane.org/gmane.comp.security.sguil.general/2416 <pre>So I'm standing up a new sguild server and I was grabbing tcpflow from http://afflib.org/downloads/tcpflow.tar.gz. Right now when that comes down it's version 1.2.3. It compiles like normal and installs and runs fine, but the xcript doesn't seem to be able to use it when pulling down transcripts/pcaps/etc. I was able to roll back to the 1.1.0 version (tarball from the other server) and it began to work like normal. The afflib site lists 1.1.0 as the latest, but 1.2.3 is what comes down. ------------------------------------------------------------------------------ Better than sec? Nothing is better than sec when it comes to monitoring Big Data applications. Try Boundary one-second resolution app monitoring today. Free. http://p.sf.net/sfu/Boundary-dev2dev </pre> Jeremy Hoel 2012-04-04T20:45:36 http://permalink.gmane.org/gmane.comp.security.sguil.general/2415 <pre>Sorry about that. It is a known bug and a fix can be found here: http://sourceforge.net/mailarchive/forum.php?thread_name=From_bamm%40users.sourceforge.net_Wed_Jun_29_03%3A07%3A28_2011&amp;forum_name=sguil-cvs Bamm On Wed, Mar 21, 2012 at 1:20 PM, LIONEL PLAZA &lt;leo240sx-Re5JQEeQqe8AvxtiuMwx3w&lt; at &gt;public.gmane.org&gt; wrote: </pre> Bamm Visscher 2012-03-22T12:04:35 http://permalink.gmane.org/gmane.comp.security.sguil.general/2414 <pre>Hello Everyone, I'm upgrading from sguil 7 to sguil 8 and so far so good. I've ran into snag with the sguil 8 client and wireshark. The situation is when I try to pull the pcap data with wireshark, I get an error "Permission Denied" to C:\tmp or it never return any errors. It's the strangest thing because the directory is there and worked fine with the sguil 7 client. I've even changed the directory to a new folder and completely opened up the security permissions for that folder and I still get the same errors. Using the transcripts options works fine and I can see the raw packet on the archive folder. Has anyone else experienced this problem? If so, how do you fix it. Thanks -Leo ------------------------------------------------------------------------------ This SF email is sponsosred by: Try Windows Azure free for 90 days Click Here http://p.sf.net/sfu/sfd2d-msazure </pre> LIONEL PLAZA 2012-03-21T17:20:21 http://permalink.gmane.org/gmane.comp.security.sguil.general/2413 <pre>In 0.8.0, the pcap agent is able to transfer pcas file w/o blocking. I had to add some additional checking to support this move to ensure duplicate request don't clobber each other. It sounds like the first request doesn't complete for some reason and the later requests are aborted b/c of the existence do the stale *.raw file. I have a couple of ideas for addressing the issue and will test them out soon. Thanks for the bug reports. Bamm On Tuesday, February 28, 2012, Keith Butler wrote: </pre> Bamm Visscher 2012-02-29T04:03:29 http://permalink.gmane.org/gmane.comp.security.sguil.general/2412 <pre>Bamm, I've been experiencing this issue, as well. I've been running 0.7.0-cvs for the last 4 years without a problem, but I've recently upgraded a server to 0.8.0-cvs and periodically get this problem. I request a pcap, things appear to start happening, but the pcap is never returned. Trying to request again results in the "request is already in queue" message. I eventually stop sguild and pcap_agent, delete the empty pcap in /tmp, and restart things. Re-requesting the pcap usually results in success. I haven't seen anything in the logs. I think maybe running everything from the command line with daemon mode disabled and debugging set to 1 is in my near future. I'll be happy to send you the results. -Keith On 02/28/2012 06:12 PM, Bamm Visscher wrote: ------------------------------------------------------------------------------ Virtualization &amp; Cloud Management Using Capacity Planning Cloud computing makes use of virtualization - but cloud computing also focuses on allowing computing to</pre> Keith Butler 2012-02-28T23:46:36 http://permalink.gmane.org/gmane.comp.security.sguil.general/2411 <pre>Thanks Bamm.... Now it's working. Thanks a lot. There was just one file: C.C.C.C:5692_S.S.S.S:80-6.raw I suppose the file was the one related with the event being exported to wireshark. Kindly, Paul El 28/02/2012 06:42 p.m., Bamm Visscher escribió: ------------------------------------------------------------------------------ Keep Your Developer Skills Current with LearnDevNow! The most comprehensive online learning library for Microsoft developers is just $99.99! Visual Studio, SharePoint, SQL - plus HTML5, CSS3, MVC3, Metro Style Apps, more. Free future releases when you subscribe now! http://p.sf.net/sfu/learndevnow-d2d </pre> Paul Marin 2012-02-28T23:47:33 http://permalink.gmane.org/gmane.comp.security.sguil.general/2410 <pre>Remove any stale pcap files (*.raw) from /tmp on the sensor. Bamm On Tue, Feb 28, 2012 at 4:40 PM, Paul Marin &lt;pmarinh45-Re5JQEeQqe8AvxtiuMwx3w&lt; at &gt;public.gmane.org&gt; wrote: </pre> Bamm Visscher 2012-02-28T23:12:56 http://permalink.gmane.org/gmane.comp.security.sguil.general/2409 <pre>log_packets.sh launches your packet logger (snort, tcpdump, daemonlogger, etc) and checks your disk usage (deleting old data to free up space as required). You add it to cron to check the disk space at regular intervals as well as to restart/redirect the packet logger into the appropriate date dir. Bamm On Tue, Feb 28, 2012 at 3:59 PM, Paul Marin &lt;pmarinh45-Re5JQEeQqe8AvxtiuMwx3w&lt; at &gt;public.gmane.org&gt; wrote: </pre> Bamm Visscher 2012-02-28T22:42:59 http://permalink.gmane.org/gmane.comp.security.sguil.general/2408 <pre>Hi Bamm.. Sguild's output: Feb 28 21:35:19 sguild-01 SGUILD: Client Command Received: XscriptRequest sensor-01 1 .sensor-01_2 {2012-02-23 19:14:33} S.S.S.S 80 C.C.C.C 5692 0 Feb 28 21:35:19 sguild-01 SGUILD: Sending sensor-01: RawDataRequest 1 sensor-01 2012-02-23 19:14:33 S.S.S.S C.C.C.C 5692 6 C.C.C.C:5692_S.S.S.S:80-6.raw xscript Feb 28 21:35:19 sguild-01 SGUILD: Sending sock20: XscriptDebugMsg .sensor-01_2 {Raw data request sent to sensor-01.} Feb 28 21:35:19 sguild-01 SGUILD: Sensor Data Rcvd: XscriptDebugMsg 1 {Request for pcap already in queue. Pls try again later} Feb 28 21:35:19 sguild-01 SGUILD: Sending sock20: XscriptDebugMsg .sensor-01_2 {Request for pcap already in queue. Pls try again later} Sguil client's system messages tab: [2012-02-28 21:35:19] sensor-01: Request for pcap already in queue. Pls try again later Kindly, Paul El 28/02/2012 04:59 p.m., Bamm Visscher escribió: ------------------------------------------------------------------------------ Keep Your Developer Skills Curr</pre> Paul Marin 2012-02-28T21:40:02 http://permalink.gmane.org/gmane.comp.security.sguil.general/2407 <pre>Paul, Can you restart sguild and pcap_agent on the sensor. Then request the transcript (once) and send the output here. Bamm On Tue, Feb 28, 2012 at 3:53 PM, Paul Marin &lt;pmarinh45-Re5JQEeQqe8AvxtiuMwx3w&lt; at &gt;public.gmane.org&gt; wrote: </pre> Bamm Visscher 2012-02-28T21:29:06 http://permalink.gmane.org/gmane.comp.security.sguil.general/2406 <pre>Hi guys, I don't really know what is the function of log_packets.sh in sguil-sensor. What does this script do exactly? Why do you need to add it to cron in order to run it periodically? Thanks in advance, Kindly Paul ------------------------------------------------------------------------------ Keep Your Developer Skills Current with LearnDevNow! The most comprehensive online learning library for Microsoft developers is just $99.99! Visual Studio, SharePoint, SQL - plus HTML5, CSS3, MVC3, Metro Style Apps, more. Free future releases when you subscribe now! http://p.sf.net/sfu/learndevnow-d2d </pre> Paul Marin 2012-02-28T20:59:50 http://permalink.gmane.org/gmane.comp.security.sguil.general/2405 <pre>Hi Bamm, sorry for the late answer. El 24/02/2012 07:22 p.m., Bamm Visscher escribió: Nothing... The problem still occurs. Kindly, Paul ------------------------------------------------------------------------------ Keep Your Developer Skills Current with LearnDevNow! The most comprehensive online learning library for Microsoft developers is just $99.99! Visual Studio, SharePoint, SQL - plus HTML5, CSS3, MVC3, Metro Style Apps, more. Free future releases when you subscribe now! http://p.sf.net/sfu/learndevnow-d2d </pre> Paul Marin 2012-02-28T20:53:31 http://permalink.gmane.org/gmane.comp.security.sguil.general/2404 <pre>Okay, you are getting the error about it being in queue b/c pcap_agent is already processing the same request. What happens if you restart pcap_agent.tcl? Bamm 2012/2/24 Paul Marin &lt;pmarinh45-Re5JQEeQqe8AvxtiuMwx3w&lt; at &gt;public.gmane.org&gt;: </pre> Bamm Visscher 2012-02-24T23:52:03 Search the mailing list at Gmane query http://search.gmane.org/?group=$group=gmane.comp.security.sguil.general