Distributed Sensor Rule MANagement for Snort

Features

• Web front end
• Multiple Sensors
• Ruleset Merge and Update
• Rule creation and editing
• Variable creation and editing
• Pre-processor configuration and editing
• Centralised databse
• Automatic sensor update & restart
• Sensor Status reporting
• Testing of uploaded rulesets before running

News

23rd August 2002 *** RMAN v0.0.5 Alpha is out ***

We also now have three developers on board - me, Larry Baumle and Michael Boman - thanks guys!

Changes from 0.0.3a ->0.0.5a
Addtions:	RMAN now handles pre-preprocessors and SNMP Status monitoring.
Fixes:	\ and : escape handling now fixed. Numerous other little changes
Updates:	A new updates directory has been created with mysql batch files to upgrade
	from 0.0.3a to 0.0.4a and from 0.0.4a to 0.0.5a

Download

Installation

Installation instructions are on the Docs Page.
If you want help please email one of the mailing lists hosted by sourceforge or email me directly - Mark Vevers.

To do list

• Better status reporting (the DB structure is now there and being filled in - now need to add full front end).
• We now have pre-processor management but still need to add output plugin management.
• We are currently working on handling of flexible resposne in a more intelligent manner - inlcudes support for SnortSAM, but could also be easily extended.

Screenshots

Here are a few of screen shots for you - the rule group maintenance screen and the rule editing screen, click on the thumbnails below for full screen shots:
(Astute people might notice that the rule ID in the editing screen is show as Unknown - this is because the rule has not yet been saved!)

One final request, if you use this software please drop me a line to let me know.

Many Thanks, Mark