ACID: Alert Groups
Alerts groups (AG) are a method by which alerts can be logically grouped. For example, an AG can be used to associate multiple alerts that compose an incident or to assign priority. Likewise, AG is currently the only way annotation can be done on a single or multiple alerts. AGs are supported by extending the basic Snort database structure.
Fundamentally an AG consists of the following items:
- ID number: a unique identification number
- Name: a human-readable name
- Description: an unstructured text comment
There are several administrative tasks which can be performed on an AG (accessed through 'Alert Group Maintenance').
- List All: displays all the AGs.
- Create: creates a new alert group.
- View: displays the ID/Name/Description of the AG, as well as all the associated alerts.
- Edit: edits the meta-data of the AG (Name/Description).
- Delete: deletes the AG. Any alerts in the AG are NOT deleted from the database.
- Clear: removes/clears all the alerts from the AG. The alerts are NOT actually deleted from the database, but only removed from the AG.
Adding Alerts to an Alert Group
- Create an Alert group.
- Run a query (e.g. Last 15 Alerts, Today's Alerts).
- At the bottom of the query results will be an 'Action' box.
The first combo-box defines the possible operations which can be performed on the current alerts.
- Add to AG (by ID): adds the specified alerts into the alert group defined by a particular AG ID #
- Add to AG (by Name): adds the specified alerts into the alert group defined by a AG Name
The text-box following the combo-box should be filled in with either an AG ID or Name depending on the combo-box value.
Finally, the alerts which will be added into the group need to be specified. This selection is achieved by choosing one of the three 'Action' buttons.
- Selected: adds those alerts which have been checked (note the check boxes in the extreme left-hand column)
- ALL on Screen: adds all alerts currently displayed on the screen
- Entire Query: adds all alerts in this query/report
Errata about Alert Groups
- An alert can be in multiple groups.
- Deleting a group does not delete the alerts in the group.
- As of yet (0.9.5), there is no support for adding an AG group into another AG group.