ACID: Alert Groups

Alerts groups (AG) are a method by which alerts can be logically grouped. For example, an AG can be used to associate multiple alerts that compose an incident or to assign priority. Likewise, AG is currently the only way annotation can be done on a single or multiple alerts. AGs are supported by extending the basic Snort database structure.

Fundamentally an AG consists of the following items:

There are several administrative tasks which can be performed on an AG (accessed through 'Alert Group Maintenance').

Adding Alerts to an Alert Group

  1. Create an Alert group.
  2. Run a query (e.g. Last 15 Alerts, Today's Alerts).
  3. At the bottom of the query results will be an 'Action' box.

    The first combo-box defines the possible operations which can be performed on the current alerts.

    The text-box following the combo-box should be filled in with either an AG ID or Name depending on the combo-box value.

    Finally, the alerts which will be added into the group need to be specified. This selection is achieved by choosing one of the three 'Action' buttons.

Errata about Alert Groups