IDABench v1.0 Documentation

George Bakos, with contributions from Doug Hill, ISTS - Dartmouth College. idabench_dev@ists.dartmouth.edu

1. Introduction

• 1.1 Overview
• 1.2 Heritage and naming

2. Version 1.0 Features

• 2.1 Ease of installation
• 2.2 Modular, pluggable design
• 2.3 Output type and formatting
• 2.4 Sensor
• 2.5 Security
• 2.6 File system

3. Concepts of Operation

• 3.1 Raw data capture
• 3.2 Partial captures
• 3.3 Raw data retrieval
• 3.4 Analysis
• 3.5 Files maintenance and cleanup

4. Requirements

• 4.1 Hardware
• 4.2 Operating system and software

5. Sensor Installation

• 5.1 Quick install
• 5.2 More detailed sensor installation
• 5.3 Uninstalling

6. Analyzer Installation

• 6.1 Quick install
• 6.2 The grubby details

7. Configuration

• 7.1 Analyzer config
• 7.2 Sensor config

8. Hourly plugin filters

• 8.1 tcpdump filters
• 8.2 ngrep filters
• 8.3 findscan filters

9. Ad-hoc searches

• 9.1 The interface
• 9.2 Standard search options
• 9.3 Search plugins
• 9.4 Repeat queries

10. Writing plugins

• 10.1 Hourly Analysis Plugins
• 10.2 Search plugins
• 10.3 Search Form Details

11. Additional notes

• 11.1 Debugging
• 11.2 Support

12. Contributors