All Apps and Add-ons

How I can use IP-reputation with snort alert logs?

hespinoza
New Member

hello:

How I can use IP-reputation with snort alert logs?

thanks

0 Karma

hespinoza
New Member

EXTRACT-clientip = (?\d+.\d+.\d+.\d+)(?::\d+)* -> \d+.\d+.\d+.\d+(?::\d+)\s$

0 Karma

Matthias_BY
Communicator

Hi,

you need to extract the source ip address into the "clientip" field. once done you can create lookups with

| lookup threatscore clientip | table clientip threatscore

you'll then have a table with all attacking ip's + the threat score enriched. In case you have a lot of logs - you might do this via summary reports to avoid that everytime you review your report it's loaded and the lookup is generating a lot of dns requests.

br
matthias

0 Karma

Ayn
Legend

Well how DO you want to use IP reputation with snort alert logs?

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!