1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
|
SEC (Simple Event Correlator) 2.7.10
Introduction:
-------------
SEC is an event correlation tool for advanced event processing which can be
harnessed for event log monitoring, for network and security management, for
fraud detection, and for any other task which involves event correlation.
Event correlation is a procedure where a stream of events is processed,
in order to detect (and act on) certain event groups that occur within
predefined time windows. Unlike many other event correlation products which
are heavyweight solutions, SEC is a lightweight and platform-independent
event correlator which runs as a single process. The user can start it as a
daemon, employ it in shell pipelines, execute it interactively in a terminal,
run many SEC processes simultaneously for different tasks, and use it in a
wide variety of other ways.
Availability:
-------------
This program is distributed under the terms of GNU General Public License,
and can be downloaded from http://simple-evcorr.github.io
Release Notes:
--------------
SEC has been tested primarily on Linux and Solaris, but since it is written
in Perl and does not use any platform dependent subroutines, it should also
work on other OS platforms.
Because SEC is not tested against ancient Perl releases, it is recommended
to run SEC with at least Perl 5.8 (see http://www.perl.org for the latest
stable release).
SEC uses Perl Getopt, POSIX, Fcntl, Socket, IO::Handle, and Sys::Syslog
modules which are included in the standard Perl installation (the presence
of Sys::Syslog is optional).
Files in this package:
----------------------
COPYING - copy of GNU General Public License
ChangeLog - changes starting from version 1.0
README - this file
contrib - SEC user contributions
sec - SEC program
sec.man - SEC man page
Installation instructions:
--------------------------
Copy the SEC program and man page to appropriate directories, for example:
cp sec /usr/local/bin
cp sec.man /usr/local/share/man/man1/sec.1
Author:
-------
Risto Vaarandi (ristov at users d0t s0urcef0rge d0t net)
Acknowledgments:
----------------
This work is supported by SEB.
The author thanks the following people for supplying software patches,
documentation fixes, and suggesting new features:
Al Sorrell, Brian Mielke, David Lang, James Brown, Jon Frazier, Mark D. Nagel,
Peter Eckel, Rick Casey, and William Gertz.
Last but not least, the author expresses his profound gratitute to
John P. Rouillard for many great ideas and creative discussions that have
helped to develop SEC.
|
