# Sagan (software)

> Mediated Wiki article. Canonical URL: https://mediated.wiki/source/Sagan_(software)
> Markdown URL: https://mediated.wiki/source/Sagan_(software).md
> Source: https://en.wikipedia.org/wiki/Sagan_(software)
> Source revision: 1309646316
> License: Creative Commons Attribution-ShareAlike 4.0 International (https://creativecommons.org/licenses/by-sa/4.0/)

**Sagan[1]** is an open source ([GNU](/source/GNU)/[GPLv2](/source/GPLv2)) [multi-threaded](/source/Thread_(computing)#Multithreading), high performance, real-time [log analysis](/source/Log_analysis) & correlation engine developed by Quadrant Information Security that runs on [Unix](/source/Unix) operating systems. It is written in C and uses a multi-threaded architecture to deliver high performance log & event analysis. Sagan's structure and rules work similarly to the [Sourcefire](/source/Sourcefire) [Snort](/source/Snort_(software)) IDS/IPS engine. This allows Sagan to be compatible with [Snort](/source/Snort_(software)) or [Suricata](/source/Suricata_(software)) rule management software and gives Sagan the ability to correlate with Snort IDS/IPS data.

Sagan supports different output formats for reporting and analysis, log normalization, script execution on event detection, GeoIP detection/alerting and time sensitive alerting.

## See also

- [Host-based intrusion detection system comparison](/source/Host-based_intrusion_detection_system_comparison)

## References

1. ["Sagan Main Wiki"](https://wiki.quadrantsec.com/bin/view/Main/SaganMain). *Sagan Main Wiki*. Champ Clark.

## Sources

- [HOWTO build Sagan on FreeBSD](https://github.com/shadowbq/sagan-extras/blob/master/sagan_freebsd.howto.md)
- [Champ Clark talks about Sagan on "Pauldotcom Security weekly" - December, 12th, 2013.](http://traffic.libsyn.com/pauldotcom/PaulDotCom-356-Part1.mp3)
- [Log, Log, Log Everything Remotely.](http://handlers.sans.org/gbruneau/papers/Guy_Bruneau_BSides_Ottawa_2014.pdf)

## External links

- [About Sagan](https://quadrantsec.com/sagan_solution/)
- [Official Sagan Wiki](https://web.archive.org/web/20150721121918/https://wiki.quadrantsec.com/twiki/bin/view/Main/SaganMain)
- [Sagan flowbits](https://quadrantsec.com/about/blog/sagan_flowbit/)
- [Using Sagan with Bro Intelligence feeds](https://quadrantsec.com/about/blog/using_sagan_with_bro_intelligence_feeds/)
- [Sagan output to other SIEMs.](https://quadrantsec.com/about/blog/sagan_output_to_other_siems/)

---
Adapted from the Wikipedia article [Sagan (software)](https://en.wikipedia.org/wiki/Sagan_(software)) by Wikipedia contributors ([contributor history](https://en.wikipedia.org/wiki/Sagan_(software)?action=history)). Available under [Creative Commons Attribution-ShareAlike 4.0 International](https://creativecommons.org/licenses/by-sa/4.0/). Changes may have been made.