Snort is a network intrusion detection and prevention system. It is the most widely deployed technology of its kind in the world. It performs detection using a variety of methods including rules-based detection, anomaly detection, and heuristic analysis of network traffic. Its rules language is open source and available to the public as well.
Check_MK is a complex addon for Nagios/Icinga and consists of three subprojects. The check and inventory system Check_MK is a general purpose Nagios plugin for retrieving data. It adopts a new approach for collecting data and obsoletes NRPE, check_by_ssh, NSClient, and check_snmp. It features a significant reduction of CPU use on the Nagios host and automatic inventory of items to be checked, and is especially useful with larger Nagios installations. "MK Livestatus" gives immediate and fast access to live and historic Nagios status data. It's a supported backend for many addons including NagVis, NagiosBP, and Thruk. "Check_MK Multisite" is a feature complete replacement for the Nagios GUI, and uses MK Livestatus as a backend. It is very fast, and supports efficient distributed monitoring.
LogAnalyzer is a Web front-end for syslog and other network event data. It provides easy browsing, searching, basic analysis, and some graphics. Data is taken from databases or plain syslog text files, so LogAnalyzer does not require changes to an existing logging infrastructure. Depending on the log data present, it can process syslog messages, Windows event log entries, and some more exotic things. Its troubleshooting support enables users to quickly find solutions to problems seen in the log data. LogAnalyzer was previously called phpLogCon, and has been renamed since v3.
Performance Co-Pilot (PCP) is a framework and set of services for supporting system-level performance monitoring and performance management. It provides a unifying abstraction for all of the interesting performance data in a system, and allows client applications to easily retrieve and process any subset of that data using a single API. A client-server architecture allows multiple clients to monitor the same host, and a single client to monitor multiple hosts. Archive logging and replay are integrated so that a client application can use the same API to process real-time data from a host or historical data from an archive.
Unattended installation of several Linux(kickstart,preseed,autoyast) and Windows(2000,XP,2003,2003R2,Vista,7,8,2008,2012). Features: inventory, software management, dhcp-ldap, dns-ldap, php-ssh, syslog-ng, rsyslog, switch managment, ldap browser, pxe manager, central cron management, license management.
Pandora FMS is a software-monitoring tool created for all kinds of companies. It is specially designed for large environments, and works by first managing servers, applications, and communications, and then notifying clients of problems and failures before they occur. Pandora FMS also includes a configurable report system that evaluates and notifies the client on the level of fulfillment and compliance of their systems. It supports all kinds of technologies unifying the management tools of your system, such as performance monitoring, network monitoring, and availability management. Pandora FMS makes your company management more agile and improves your process performance.
360-FAAR (Firewall Analysis Audit and Repair) is an offline, command line, Perl firewall policy manipulation tool to filter, compare to logs, merge, translate, and output firewall commands for new policies, in Checkpoint dbedit, Cisco ASA, or ScreenOS commands. It is all contained in one file. It can read policy and logs for: Checkpoint FW1 (in odumper.csv / logexport format), Netscreen ScreenOS (in get config / syslog format), and Cisco ASA (show run / syslog format). It uses both inclusive and exclusive CIDR and text filters, permitting you to split large policies into smaller ones for virutalization at the same time as removing unused connectivity. It supports policy to log association, object translation, rulebase reordering and simplification, rule moves, and duplicate matching automatically. It allows you to seamlessly move rules to where you need them. 'print' mode creates a spreadsheet for your audit needs with one command.
Snortalog is a powerful Perl script that summarizes Snort logs, making it easy to view any network attacks detected by Snort. It can generate charts in HTML, PDF, and text output. It works with all versions of Snort, and can analyze logs in three formats: syslog, fast, and full snort alerts. Moreover, it is able to summarize other logs like CheckPoint, Netfilter, IPFilter, Packet Filter, Cisco PIX/ASA, NetScreen, TippingPoint, and Lucent BRICK in a similar way.
cdpr (Cisco Discovery Protocol Reporter) shows the switch and port that a machine is connected to, provided that the device supports CDP. It can also optionally decode the full CDP packet. cdpr was written to help network/system administrators find out about the equipment that a machine is connected to. This is done by capturing and decoding a Cisco Discovery Protocol (CDP) packet.