View source for Sguil

{{Short description|Network management software}}
{{Infobox software
| name                   = Sguil
| author                 = [[Bamm Visscher, Steve Halligan]]
| released               =
| latest release version = 0.9.0<ref>[https://bammv.github.io/sguil/downloads.html Squil downloads]</ref>
| latest release date    = {{Start date and age|2014|04|04}}
| programming language   = [[Tcl]]/[[Tk (software)|Tk]]
| operating system       = [[Cross-platform]]
| genre                  = [[Network Security Monitoring]]
| license                = [[GPLv3]]
| website                = {{URL|http://sguil.sourceforge.net/}}
}}
'''Sguil''' (pronounced ''sgweel'' or ''squeal'') is a collection of free [[software]] components for [[Network Security Monitoring]] (NSM) and event driven analysis of [[Intrusion detection system|IDS]] alerts.<ref name="NHS"/> The sguil client is written in [[Tcl]]/[[Tk (software)|Tk]]<ref name="RJ1"/><ref name="NHS"/> and can be run on any operating system that supports these.  Sguil integrates alert data from [[Snort (software)|Snort]], session data from SANCP, and full content data from a second instance of Snort running in packet logger mode.
Sguil is an implementation of a Network Security Monitoring system. NSM is defined as "collection, analysis, and escalation of indications and warnings to detect and respond  to intrusions."
Sguil is released under the GPL 3.0.<ref>README file in the tarball</ref>
==Tools that make up Sguil==
{| class="wikitable"
|-
! Tool !! Purpose
|-
| [[MySQL]] 4.x or 5.x  || Data storage and retrieval
|-
| [[Snort (software)|Snort]] 2.x / [[Suricata (software)|Suricata]]  || Intrusion detection alerts, scan detection, packet logging
|-
| Barnyard / Barnyard2  || Decodes IDS alerts and sends them to sguil
|-
| SANCP  || TCP/IP session records
|-
| [[Tcpflow]] || Extract an ASCII dump of a given TCP session
|-
| [[p0f]]  || Operating system fingerprinting
|-
| [[tcpdump]] || Extracts individual sessions from packet logs
|-
| [[Wireshark]]  || Packet analysis tool (used to be called Ethereal)
|}<ref name="CoxGerg"/>
== See also ==
{{Portal|Free Software}}
* [[Sagan (software)|Sagan]]
* [[Intrusion detection system]] (IDS)
* [[Intrusion prevention system]] (IPS)
* [[Network intrusion detection system]] (NIDS)
* [[Metasploit Project]]
* [[nmap]]
* [[Host-based intrusion detection system comparison]]
==References==
{{reflist|2|refs=
<ref name="NHS">{{cite book|title=Network Security Hacks|isbn=978-0596527631|edition=2nd|date=9 November 2006|first=Andrew|last=Lockhart|publisher=O'Reilly Media|chapter=11: Network Intrusion Detection|id=Hack 108 - Monitor Your IDS in Real Time - Use Sguil's advanced GUI to monitor and analyze IDS events in a timely manner}}</ref>
<ref name="RJ1">{{cite book|title=The Practice of Network Security Monitoring: Understanding Incident Detection and Response|publisher=No Starch Press|edition=1st|date=5 August 2013|section=8.2 Using sguil|isbn=978-1593275099|first=Richard|last=Bejtlich}}</ref>
<ref name="CoxGerg">{{cite book|title=Managing Security with Snort & IDS Tools - Intrusion Detection with Open Source Tools|date=February 2009|publisher=O'Reilly Media|chapter=13: Strategies for High-Bandwidth Implementations of Snort|id=Sguil: An alternative Management Console|page=223|first1=Kerry|last1=Cox|first2=Christopher|last2=Gerg|isbn=978-0596006617}}</ref>
}}
==External links==
*[http://sguil.sourceforge.net Sguil Homepage]
[[Category:Computer network security]]
[[Category:Linux security software]]
[[Category:Free network management software]]
[[Category:Software that uses Tk (software)]]
{{security-software-stub}}