devialog
devialog is a behavior/anomaly/signature-based syslog intrusion detection system which can detect new, unknown attacks. It fits comfortably in a heterogeneous Unix/Linux/*BSD environment at the core of a central syslog server. devialog generates its own signatures and acts upon anomalies as configured by the system administrator. In addition, devialog can function as a traditional syslog parsing utility in which known signatures trigger actions.
| Tags | Internet Log Analysis Security Logging Monitoring Systems Administration |
|---|---|
| Implementation | Perl |
Recent releases
- 05 Jul 2007 05:50
Release Notes: Bug fixes include better handling of lines with some special characters. A timing error was fixed within alert generation: sometimes alerts would be sent inadvertently based on the timing of a new log arriving as an alert was sent out in specific high-volume log situations. Altered signature generation creates more exact regular expressions.
- 01 Jun 2005 07:42
Release Notes: Two new fields were added to signatures: comments and line. The comments field allows one to associate a comment with each signature. The line field enables the original syslog message in which the signature is based to be stored in the signature itself. A bug which would prevent non-standard syslog formats from being parsed was fixed. This enabled support for many more devices.
- 11 Apr 2005 07:46
Release Notes: Mail queueing was enabled, so in the event that many anomalies appear, only one email is sent with multiple anomalies per default. A suggested signature logfile was added, in which devialog continuously (and optionally) writes suggested signatures during runtime to a pre-defined location. When combined with devialogsig, it's an easier way to add signatures. devialog requires the new version of the configuration file. Do not use the old configuration format, since there are far too many new options added.
- 28 Feb 2005 22:54
No changes have been submitted for this release.
jeph
28 Feb 2005 21:09
Heartbeat
- Popularity Score
- 50.00
- Vitality Score
- 2.46
- Subscriptions
- 24
