All Apps and Add-ons

is it possible to parse and index snort payload ?

gooza
Communicator

I'm trying to index snort data and I'm having problems with the payload since it is in hex/binary
anyone know if it possible to index the payload ?

0 Karma

jbsplunk
Splunk Employee
Splunk Employee

There is some pretty good documentation on this topic here:

http://commons.oreilly.com/wiki/index.php/Snort_Cookbook/Logging,_Alerts,_and_Output_Plug-ins

0 Karma

Ayn
Legend

It is possible to index it if you convert it to a non-binary format. There is no out-of-the-box solution that I know of for doing this however. Software such as barnyard may or may not support this by now, but last time I checked there was no specific output plugin for packet payloads in ASCII format. What Snort logs are you feeding Splunk with?

Ayn
Legend

Those are just the software versions. Snort can be configured to output various kinds of logs, as can barnyard. The most common scenario is to have Snort output a binary alert file and then have Barnyard read it, then using one or more output plugins to write the results in one way or another to files, databases etc. Looking at the most recent configuration options for barnyard, it seems the output module "log_ascii" may help you achieve what you want.

gooza
Communicator

snort 2.9.0.5 , Barnyard 2.1.9

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...