topic Re: How I can use IP-reputation with snort alert logs? in All Apps and Add-ons

How I can use IP-reputation with snort alert logs?

hespinoza — Fri, 28 Jun 2013 17:56:24 GMT

hello:

How I can use IP-reputation with snort alert logs?

thanks

Re: How I can use IP-reputation with snort alert logs?

Ayn — Fri, 28 Jun 2013 18:33:12 GMT

Well how DO you want to use IP reputation with snort alert logs?

Re: How I can use IP-reputation with snort alert logs?

Matthias_BY — Wed, 10 Jul 2013 10:44:26 GMT

Hi,

you need to extract the source ip address into the "clientip" field. once done you can create lookups with

| lookup threatscore clientip | table clientip threatscore

you'll then have a table with all attacking ip's + the threat score enriched. In case you have a lot of logs - you might do this via summary reports to avoid that everytime you review your report it's loaded and the lookup is generating a lot of dns requests.

br
matthias

Re: How I can use IP-reputation with snort alert logs?

hespinoza — Fri, 19 Jul 2013 21:46:55 GMT

EXTRACT-clientip = (?\d+.\d+.\d+.\d+)(?::\d+)* -> \d+.\d+.\d+.\d+(?::\d+)\s$