All Apps and Add-ons

is it possible to parse and index snort payload ?

gooza
Communicator

I'm trying to index snort data and I'm having problems with the payload since it is in hex/binary
anyone know if it possible to index the payload ?

0 Karma

jbsplunk
Splunk Employee
Splunk Employee

There is some pretty good documentation on this topic here:

http://commons.oreilly.com/wiki/index.php/Snort_Cookbook/Logging,_Alerts,_and_Output_Plug-ins

0 Karma

Ayn
Legend

It is possible to index it if you convert it to a non-binary format. There is no out-of-the-box solution that I know of for doing this however. Software such as barnyard may or may not support this by now, but last time I checked there was no specific output plugin for packet payloads in ASCII format. What Snort logs are you feeding Splunk with?

Ayn
Legend

Those are just the software versions. Snort can be configured to output various kinds of logs, as can barnyard. The most common scenario is to have Snort output a binary alert file and then have Barnyard read it, then using one or more output plugins to write the results in one way or another to files, databases etc. Looking at the most recent configuration options for barnyard, it seems the output module "log_ascii" may help you achieve what you want.

gooza
Communicator

snort 2.9.0.5 , Barnyard 2.1.9

0 Karma
Get Updates on the Splunk Community!

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Tips & Tricks When Using Ingest Actions

Tune in to learn about:Large scale architecture when using Ingest ActionsRegEx performance considerations ...