Project

General

Profile

Feature #11579

Snort alerts or blocks trigger notifications

Added by Offstage Roller 3 months ago.

Status:
New
Priority:
Normal
Assignee:
-
Category:
Snort
Target version:
-
Start date:
03/01/2021
Due date:
% Done:

0%

Estimated time:

Description

I use the default pfSense notifications under System -> Advanced -> Notifications, and I'd love to be able to receive notifications when Snort either alerts or blocks something.

Currently, if Snort blocks something and I notice an issue with a device on my network, I need to log into pfSense to check and see if Snort is the cause of my issue. But since I use Pushover for notifications, I'd love to be notified as soon as Snort blocks something, so I don't have to wonder anymore.

It would also be nice even if I'm not working on a device on my network, to know when Snort took an action to block something. I tune Snort so that blocks are rare, but when they do happen I'd like to know about it right away.

The nut package does this, where in the UPS Settings there's a checkbox for "Notifications" if you want to be notified for UPS related events.

Also available in: Atom PDF