Snort has the option to do Active Response if that's what you mean by integrated response. When you compile the initial package, include the --enable-flexresp and it will have the ability. You also have to tell each signature what to do. Plug the "resp: xxxxx" into the signature and it'll respond in a variety of ways. This is actually one of my bigger complaints with Snort. As capable as it is, it has no integrated response capabilities other than to shoot off alerts. You'd have to custom build a response mechanism for it, which isn't easy.
This archive was generated by hypermail 2b30 : Wed Aug 28 2002 - 16:16:40 PDT