defensative/def-sagan repository overview

⁠Welcome to the README file

What is Sagan?

Sagan is an open source (GNU/GPLv2) high performance, real-time log analysis & correlation engine. It is written in C and uses a multi-threaded architecture to deliver high performance log & event analysis. The Sagan structure and Sagan rules work similarly to the Sourcefire "Snort" IDS engine. This was intentionally done to maintain compatibility with rule management software (oinkmaster/pulledpork/etc) and allows Sagan to correlate log events with your Snort IDS/IPS system. Since Sagan can write to Snort IDS/IPS databases via unified2/barnyard2, it is compatible with all Snort "consoles". For example, Sagan is compatible with Snorby [http://www.snorby.org⁠], Sguil [http://sguil.sourceforge.net⁠], BASE, and the Prelude IDS framework! (to name a few).

Sagan supports many different output formats, log normalization (via liblognorm), GeoIP detection, script execution on event and automatic firewall support via "Snortsam" (see http://www.snortsam.net⁠).

Sagan uses the GNU "artisic style".

For more information, please visit the Sagan web site: http://sagan.quadrantsec.com⁠.

If you're looking for Sagan rules on Github, they are located at:

https://github.com/beave/sagan-rules⁠