Recently a rather significant issue with sancp 1.6.2 (release.C) was identified which prevented sguil client users being able to perform queries on the sancp data.

Whilst the data was being captured by sancp it, unfortunately it was not making its way to the sguil server. its data being flush at the expected intervals. The only way to force sancp to flush its information to file was to force a close process and restart it. This is not the ideal solution and so we have reverted to 1.6.1 which we have confirmed works as expected.

It was also a good time to update barnyard2 to a recent 2-0.5 version so that made its way into this stability update.

Enjoy!

Given that all our work is typically built on a Debian system and tested on at least Debian/Ubuntu systems we don’t always expect them to work on others straight out of the box. We’ve had some feedback recently of the efforts to compile barnyard2 on FreeBSD machines and with a little TLC we’ve applied the appropriate patches for it work.

In addition we tracked down a peculiar bug with relatively addressed filenames in batch mode, which should now work as expected.

And finally the parameter parsing of the spo_sguil output plugin has been modified to align with the spo_database output plugin and now expects “key=value” pairs in the configuration file instead of the old “key value” pairs.

Enjoy!

With the large amount of feedback we received from the Knoppix-NSM distribution we thought how would we do this if we had the time to do it again. What we’ve been working on over the past few months is a number of foundation applications, namely barnyard2 and NSMnow, that will aid the integration of security applications to provide a stable NSM framework.

Even with the simplicity of NSMnow some people will still rather test out the features of something new via the easiest means possible. By todays standards that means is typically the live CD or live USB mediums.

Securix-NSM is the direct successor of Knoppix-NSM, based on a more pure Debian system, giving you all the benefits of the most used NSM applications pre-configured and ready to go. From our perspective this is the best mechanism for presenting NSM related applications on the Debian platform.

If you have any feedback or would even like to become involved with improving the Securix-NSM platform then by all means let us know.

So head over to the Securix-NSM project page to grab a copy. We’ll also keep the Knoppix-NSM links a live for sometime until we’re happy that all documentation has be ported across and that a full transition has been completed.