Step 7: Watch and Tune

Now that everything is running, you can tune the maxAlerts variable to suit your environment so you are not always in the red.
You have now moved your IDS signatures off of the screen and in to the real world, hopefully improving your situational awareness. Also you got to play with Arduinos!

Thanks for looking!

Please I need help in step 5 <br> <br>I can see there is 2 small resistors with blue color ... what they are for <br> <br>i'm stack in this step !! i'm doing my final project in uni <br> <br>hope you can help me <br> <br>Thanks
Hi guys! I'm trying to setup snort on mac, I've install it, and i tryied to modify the file config.snort, but I don't understand what i I've to do, which line I need to modify to create che log file alert.csv. <br> <br>can you help me please ? <br> <br>my email is simo90@me.com <br> <br>thanx!!!
I would suggest posting/searching the snort website, they will be able to help you much better.
can anyone please help me with step 5 as i am not able to go through snort
Could you make an instuctable showing us how to do this with the xbee wifi protoshield. Personally I think that would be more helpful because then it could be placed anywhere within the networks range.
Hey SGleason1 - I would love to make one of these with an Xbee. It will have to wait until I buy one though! <br><br>-Joe<br>
Hello Joe, Thank you for the great project. <br>Like S.Gleason pointed, if you could assemble one with Xbee, I would be highly interested in it. You may also have a thorough user info along with that. <br>I am not a great Computer wizzard like you nice guys !! <br>Kindly respond to my mail if that is possible, please. <br>Thanks. <br>Sincerely <br>KJ Kumar <br>kjkumarsfo@yahoo.com
Hey Sreeci and Sgleason - I ordered up an Xbee. So I'll post a new wireless instructable up when I get it in. <br><br>-Joe
Sweet I can't wait to see it. I don't have an arduino yet or the knowledge of how snort works, but I thought that if you made it with an xbee it would be much easier to put into same sort of frame and keep around the house, or bring it into your living room while watching tv.
Hey Sreeci and Sgleason - Here is a wireless version of the device:<br>https://www.instructables.com/id/Visual-Network-Threat-Level-Indicator-v2/<br><br>Thanks for looking. <br><br>-Joe<br>
Hmmm,,, gotta get an Ethernet Shield now... Nice write up.
Just out of curiosity, where did you get the LED bar graph?
Hey Mr Monoply33 - It is an Avago HDSP4832, You can get it from Jameco here: <br>http://www.jameco.com/webapp/wcs/stores/servlet/Product_10001_10001_1551402_-1<br><br>-Joe<br>
Very nice project. But i always wonder why no one ever trys to run the Arduino with Power over Ethernet.<br>
Hey Kaylonds - Thanks! <br><br>As far as PoE, for me the reason is simple; I don't have a network switch which can provide PoE. I'm not sure how many home users do either. <br><br>-Joe<br>
true true.
How do you think this would do running with Suricata instead of Snort?
Hey Nubuzz- If Suricata has a log, then it would work. If you can give me a sample of 2 lines from the log file, I'll update the python to have a suricata/snort switch. <br><br>-Joe
Very nice!<br>I like the use of Arduino showing important information, and Snort by all means is a good thing to monitor (and hopefully not too many false positive generated on your network). On the pictures I see a chip on the proto-shield, is that part of the circuit somehow or there from a something different?
Hey Zmashiah- thanks! That chip is a 470&Omega; resistor network, you don't need it you can use individual resistors. I just had it on hand and find them easy to use.<br><br>They can be found at Jameco #108581 http://www.jameco.com/webapp/wcs/stores/servlet/Product_10001_10001_108581_-1<br><br>-Joe<br>
cool stuff

About This Instructable




Bio: I like to tinker with just about anything, sometimes it works out in the end. Have fun looking at the projects, try tearing something open ... More »
More by joe:Intel Edison Garage Monitor and Alert System Intel Edison Fat Bike Tire Analyzer Intel Galileo Garage Monitor 
Add instructable to: