'SnortDLP'에 해당되는 글 1건

  1. 2014.07.08 SnortDLP - an open source DLP solution utilizing snort
2014. 7. 8. 19:08

SnortDLP - an open source DLP solution utilizing snort


SnortDLP a.k.a. "Pig Pen" is an open source data loss prevention project that utilizes Snort to detect the exfiltration of sensitive data.


Web based application

  • Written in PHP and utilizes a MySQL backend for cross operating system portability
  • Administrative login to protect unauthorized access
  • Determines a unique fingerprint for
    • free text
    • individual documents
    • each document in a repository of sensitive documents
    • database tables (future)
  • Supports plain text documents (including doc, ppt, etc) and emails
  • Generates Perl-compatible regular expressions (PCREs) and automatically adds a custom snort rule for each document or file
  • Detects and alerts administrators through a Snort interface
  • Flagging and carving out zip/pdf files based on file headers
    • Office 2007 (docx, pptx, xlsx) support
    • PDF support


  • Email integration


-python -- version?
-pexpect for python (already installed on ubuntu I believe)
-tcpxtract 1.0.1
apt-get install libxml-libxml-perl
apt-get install libarchive-any-perl
libextractor -> apt-get install extract

-in /etc/sudoers
-- under: # User privilege specification
-- add: www-data ALL=NOPASSWD: /bin/mount, /bin/umount, /bin/mkdir, /bin/rmdir

출처 : https://code.google.com/p/snortdlp/

Trackback 0 Comment 0