All Apps and Add-ons

is it possible to parse and index snort payload ?

gooza
Communicator

I'm trying to index snort data and I'm having problems with the payload since it is in hex/binary
anyone know if it possible to index the payload ?

0 Karma

jbsplunk
Splunk Employee
Splunk Employee

There is some pretty good documentation on this topic here:

http://commons.oreilly.com/wiki/index.php/Snort_Cookbook/Logging,_Alerts,_and_Output_Plug-ins

0 Karma

Ayn
Legend

It is possible to index it if you convert it to a non-binary format. There is no out-of-the-box solution that I know of for doing this however. Software such as barnyard may or may not support this by now, but last time I checked there was no specific output plugin for packet payloads in ASCII format. What Snort logs are you feeding Splunk with?

Ayn
Legend

Those are just the software versions. Snort can be configured to output various kinds of logs, as can barnyard. The most common scenario is to have Snort output a binary alert file and then have Barnyard read it, then using one or more output plugins to write the results in one way or another to files, databases etc. Looking at the most recent configuration options for barnyard, it seems the output module "log_ascii" may help you achieve what you want.

gooza
Communicator

snort 2.9.0.5 , Barnyard 2.1.9

0 Karma
Get Updates on the Splunk Community!

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...

Thank You for Celebrating CX Day with Splunk!

Yesterday the entire team at Splunk + Cisco joined the global celebration of CX Day - celebrating our ...