 




<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Irregular Expressions &#187; cisco mars</title>
	<atom:link href="http://itknowledgeexchange.techtarget.com/Irregular-Expressions/tag/cisco-mars/feed/" rel="self" type="application/rss+xml" />
	<link>http://itknowledgeexchange.techtarget.com/Irregular-Expressions</link>
	<description>Insight into current security related events and exploits, including virtualization security and tips.</description>
	<lastBuildDate>Sun, 28 Apr 2013 08:00:32 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	
		<item>
		<title>Opensource Event Correlation System &#8211; Part 2</title>
		<link>http://itknowledgeexchange.techtarget.com/Irregular-Expressions/opensource-event-correlation-system-part-2/</link>
		<comments>http://itknowledgeexchange.techtarget.com/Irregular-Expressions/opensource-event-correlation-system-part-2/#comments</comments>
		<pubDate>Thu, 22 Jul 2010 16:21:48 +0000</pubDate>
		<dc:creator>Dan O'Connor</dc:creator>
				<category><![CDATA[cisco mars]]></category>
		<category><![CDATA[sagan]]></category>
		<category><![CDATA[syslog]]></category>

		<guid isPermaLink="false">http://itknowledgeexchange.techtarget.com/Irregular-Expressions/opensource-event-correlation-system-part-2/</guid>
		<description><![CDATA[Ok I got it installed on FreeBSD. Download the latest version, it should be 0.1.3 right now. fetch http://sagan.softwink.com/download/sagan-0.1.3.tar.gz Unpack where yo want it, tar -xvf sagan-0.1.3.tar.gz Next do the old configure make, but you need to add some environmental settings. (The install file does not handle this yet) LDFLAGS=-L/usr/local/lib CFLAGS=-I/usr/local/include ./configure &#38;&#38; make &#38;&#38; [...]]]></description>
				<content:encoded><![CDATA[<p>Ok I got it installed on FreeBSD.</p>
<p>Download the latest version, it should be 0.1.3 right now.</p>
<pre>fetch http://sagan.softwink.com/download/sagan-0.1.3.tar.gz</pre>
<p>Unpack where yo want it,</p>
<pre>tar -xvf sagan-0.1.3.tar.gz</pre>
<p>Next do the old configure make, but you need to add some environmental settings. (The install file does not handle this yet)</p>
<pre>LDFLAGS=-L/usr/local/lib CFLAGS=-I/usr/local/include ./configure &amp;&amp; make &amp;&amp; make install</pre>
<p>Once that is completed you need to download the rule sets and configure sagan, check out the how-to on the site.</p>
<p>Also you will need to install syslog-ng and setup a fifo, again this is covered in the how-to.</p>
<p>Once you have the rules setup and the the fifo, you are basically ready to go. I am using the email output to send the alerts for now, but I am going to need to start tuning soon.</p>
<p>I also setup a rc script to control the service.</p>
<!-- wpms-network-global-inserts -->]]></content:encoded>
			<wfw:commentRss>http://itknowledgeexchange.techtarget.com/Irregular-Expressions/opensource-event-correlation-system-part-2/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>
