Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

There are some great "appliance" style distributions like pfSense and M0n0wall, that bundle powerful features of their respective operating systems with a nice web application for configuration. In my opinion, these distributions cover a majority the use cases, and make up for what they trade in flexibility for ease-of-use.

Is there a similar kind of "appliance" style distribution for Snort? I'm thinking along the lines of something with the Snort sensor, MySQL (or similar database backend), BASE and Pulled Pork configured with some sensible (although, probably not very useful defaults) and a nice web configuration utility for adding rules, viewing alerts, etc. Basically doing what PfSense does for OpenBSD/pf but only for Snort.

Has anyone come across something like this? Do you think it'd be worth putting together a project if there isn't already one?

share|improve this question

closed as off-topic by kce, mdpc, Rex, faker, Wesley Apr 25 '14 at 15:50

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking product, service, or learning material recommendations are off-topic because they tend to become obsolete quickly. Instead, describe your situation and the specific problem you're trying to solve." – kce, mdpc, Rex, faker, Wesley
If this question can be reworded to fit the rules in the help center, please edit the question.

up vote 4 down vote accepted

Check out Snorby. The "Insta-Snorby" download is the nicely packaged appliance.

share|improve this answer
Snorby looks like an excellent project. I'll take a look. Thanks. – kce May 11 '11 at 23:23

You should try the open-source, Linux distro - Security Onion. It's currently xubuntu-based but this will most likely change soon.

The blog is here -

and the installation wiki here -

It comes with everything pre-package and installed so you can run Snorby, Squert ,Sguil etc incredibly easily. You'll be up and running in 10 minutes with the easy install wizard. The sensor and server can be run on the one system or across multiple systems. Updates are automatically scheduled daily with pulledpork also.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.