SnortSam is a plugin for Snort, the open-source lightweight Intrusion Detection System (IDS). The plugin allows for automated blocking of IP addresses on a Checkpoint Firewall-1 firewall.
SnortSam itself consists of two pieces - the output plugin within Snort and an intelligent agent that runs on the firewall. The agent provides a variety of capabilities that go beyond other automated blocking mechanisms. Here are a few highlights:
* White-list support of IP addresses that will never be blocked.
* Time-override list.
* Flexible blocking specification including rule dependent blocking time interval.
* Misuse/Attack detection engine that works in conjunction with...
* ...rollback support. SnortSam keeps track of blocks and can unblock the last x blocks.
* Repetitive (same IP) block prevention within 10 sec window to improve performance.
* TwoFish encrypted communication between Snort and the SnortSam agent.
