All Apps and Add-ons

Splunk for Snort Event Question

phillijc
New Member

I'm running a bunch of sample test PCAP files through and getting output in Splunk for Snort but the events seem to be kind of random with different dates, destination IP's, etc within a single event. This is probably a dumb question but I'm wondering what categorizes an event in Splunk for Snort could someone give some insight?

Thank you

EDIT: I see in the opt/splunk/var/lib/splunk/defaultdb/db/ that there are the same number of folders as events. Gives me a little better view of what's happening but not the full picture.

Tags (1)
0 Karma

Ayn
Legend

OK, the main problem I see with your setup is that you have set the sourcetype "snort". As the installation docs for Splunk for Snort state, you need to set either snort_alert_fast for alert_fast format or snort_alert_full for alert_full format. This is because these two need to be parsed differently in order to achieve correct event breaking, and I suspect this is what is causing you problems - events are not breaking properly so event boundaries in Splunk will not correspond to event boundaries in the original log file.

phillijc
New Member

Thank you for your reply. I just thought that with a whole folder of different PCAPs who are proven attacks would trigger more events. Here's a little more info:
Data inputs monitors a file /var/log/snort/alert
Source Type: Manual, snort
Event types, these basically search the classification of the alerts. I'm currently only getting network trojans and the snort-alert (of coarse). I'm thinking my data may just simply be limited:
- snort-alert
- snort_dos
- snort_exploit
- snort_information_leak
- snort_login
- snort_potentially_bad
- snort_privilege_gain
- snort_scan
- snort_trojan

0 Karma

Ayn
Legend

Could you please provide much more details about what you're seeing and what you're expecting? It's very hard to say something useful without any actual details.

An event in Splunk for Snort is pretty much what you would consider to be an event yourself when reading the log files.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...