PSAD - Snort

sudo apt-get install psad

sudo iptables -A INPUT -j LOG
sudo iptables -A FORWARD -j LOG

nano /etc/psad/psad.conf
EMAIL_ADDRESSES - change this to your email address.
HOSTNAME - this is set during install - but double check and change to a FQDN if needed.
ENABLE_AUTO_IDS - set this to Y if you could like PSAD to take action - read configuration instructions before setting this to Y.
ENABLE_AUTO_IDS_EMAILS - set this to Y if you would like to receive email notifications of intrusions that are detected.
IPT_SYSLOG_FILE             /var/log/syslog;

psad -R
psad --sig-update
psad -H

psad --Status