Why are some fields not extracted properly forwarding Snort logs to Splunk?

[z0dski]

Edit: The long story short is the Splunk for Sourcefire TA does not have any support for alert_fast, use syslog and either modify transforms.conf or your snort config to include the PID.

I'm working in my home lab trying to get my snort alerts into Splunk, and running into an issue with sending the alerts to Splunk.

I have barnyard configured with alert_fast sending to a file called snort.log.

The splunk universal forwarder is configured like so:

[monitor:///nsm/sensor_data/onion-eth0/snort.log]
disabled = 0
sourcetype = snort

And I have the Sourcefire TA installed on my search/indexer. The extractions mostly work, but I am ending up with the signature and the signature_id fields not being extracted properly.

The raw event looks like this:

07/15-05:36:49.069979  [**] [1:2100498:8] GPL ATTACK_RESPONSE id check returned root [**] [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 82.165.177.154:80 -> 192.168.100.101:48292

I could very easily re-write the transforms.conf to get my fields out, but I have a feeling others will run into this as well. Is there a better way to get the alerts to Splunk? Should I use something other than the Sourcefire TA?

It seems like the old Splunk for Snort app worked pretty well, but I haven't had any luck with the Sourcefire one. This setup worked fine with a sourcetype="snort_alert_fast" in the old Splunk for Snort App.

Any help would be appreciated.

[z0dski · Accepted solution]

For those who come along after me, or for a bored Sourcefire TA maintainer, something to consider is that the syslog messages may not always include the PID after the process name, which was the problem in this case after I switched to syslog, rather than fast alert.

After switching to using Syslog I still had issues, sending directly or to a local file. I don't believe Barnyard2 supports including the PID (it reads from unified2, which doesn't include the PID of the snort process that wrote it, as far as I can tell). So your only option is to either modify transforms.conf to make the [$PID] part optional or to modify your snort config to use the following output:

output alert_syslog: LOG_AUTH LOG_ALERT log_pid

Here's how the alert looked after that configuration change:

Jul 16 03:46:53 onion snort[18235]: [1:2100498:8] GPL ATTACK_RESPONSE id check returned root [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 82.165.177.154:80 -> 192.168.100.101:34347

And if you wanted to change your transforms.conf, the following should do the trick, but I haven't tested it:

[signature_for_snort]
REGEX = snort(?:\[\d+\])?\:\s+\[[^\]]+\]\s+(.*?)(\s+\[Classification|\[Priority)
FORMAT = signature::"$1"

[signature_id_for_snort]
REGEX = snort(?:\[\d+\])?\:\s+\[([^\]]+)
FORMAT = signature_id::"$1"