SAGAN: An open-source event correlation system - Part 1: Installation

Published: 2010-07-18
Last Updated: 2010-07-18 23:03:04 UTC
by Manuel Humberto Santander Pelaez (Version: 1)
3 comment(s)

One of the biggest threats to effective incident response is correlating events and being aware of real incidents happening inside your network. There are some commercial alternatives like Cisco MARS and RSA Envision, but many companies can't afford those alternatives and in many situations the size of the network is not big enough to make worth the acquisition of any commercial product.

I have lived the last case and in my search I found very useful SAGAN ( It is a real time event log monitoring system that is able to detect incidents on hosts or network and can correlate information with the snort sensor present on your network. It gathers syslog events and then correlates them with other alerts such as snort logs.

What are the installation requisites? A database to save logs(I use mysql but there is also support for postgresql for those who like it), libpcre, libesmtp ( My setup was done on Ubuntu 10.04. The configure command used before compiling is ./configure --disable-postgresql. If everything goes well you should see the following:




Following step is to install the rules. By default, they are located at /usr/local/etc. Find the latest ruleset at Uncompress it at /usr/local/etc. Create sagan unprivileged user and chown /var/log/sagan and /var/run/sagan to sagan user.

Want to get windows events to correlate too? Use

I will show you a practical example next tuesday on part 2 :) More information about installation at

 -- Manuel Humberto Santander Peláez | | | msantand at isc dot sans dot org

3 comment(s)


OSSIM also can do the same job.
yes, OSSIM is a great tool for this, but its a MUCH larger task than what Sagan appears to be. Getting a fully functional OSSIM setup going is a real nightmare unless you're a very advanced *nix network admin.
It should also be noted, OSSIM or OSSEC does not store or attempt to correlate information within a Snort database. Sagan uses "Snort like" rule sets (easier management) and stores events to a Snort database as a separate sensor ID. This means you can utilize the same console for IDS/IPS to deal with your logs.

Diary Archives