Threat Level: green Handler on Duty: Brad Duncan

SANS ISC: SAGAN: An open-source event correlation system - Part 1: Installation - SANS Internet Storm Center SANS ISC InfoSec Forums

Watch ISC TV. Great for NOCs, SOCs and Living Rooms:

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
SAGAN: An open-source event correlation system - Part 1: Installation

One of the biggest threats to effective incident response is correlating events and being aware of real incidents happening inside your network. There are some commercial alternatives like Cisco MARS and RSA Envision, but many companies can't afford those alternatives and in many situations the size of the network is not big enough to make worth the acquisition of any commercial product.

I have lived the last case and in my search I found very useful SAGAN ( It is a real time event log monitoring system that is able to detect incidents on hosts or network and can correlate information with the snort sensor present on your network. It gathers syslog events and then correlates them with other alerts such as snort logs.

What are the installation requisites? A database to save logs(I use mysql but there is also support for postgresql for those who like it), libpcre, libesmtp ( My setup was done on Ubuntu 10.04. The configure command used before compiling is ./configure --disable-postgresql. If everything goes well you should see the following:




Following step is to install the rules. By default, they are located at /usr/local/etc. Find the latest ruleset at Uncompress it at /usr/local/etc. Create sagan unprivileged user and chown /var/log/sagan and /var/run/sagan to sagan user.

Want to get windows events to correlate too? Use

I will show you a practical example next tuesday on part 2 :) More information about installation at

 -- Manuel Humberto Santander Peláez | | | msantand at isc dot sans dot org

Manuel Humberto Santander Pelaacuteez

195 Posts
ISC Handler
Jul 18th 2010
OSSIM also can do the same job.
yes, OSSIM is a great tool for this, but its a MUCH larger task than what Sagan appears to be. Getting a fully functional OSSIM setup going is a real nightmare unless you're a very advanced *nix network admin.

23 Posts
It should also be noted, OSSIM or OSSEC does not store or attempt to correlate information within a Snort database. Sagan uses "Snort like" rule sets (easier management) and stores events to a Snort database as a separate sensor ID. This means you can utilize the same console for IDS/IPS to deal with your logs.

Sign Up for Free or Log In to start participating in the conversation!