is it possible to parse and index snort payload ?

[gooza]

I'm trying to index snort data and I'm having problems with the payload since it is in hex/binary
anyone know if it possible to index the payload ?

[jbsplunk]

There is some pretty good documentation on this topic here:

http://commons.oreilly.com/wiki/index.php/Snort_Cookbook/Logging,_Alerts,_and_Output_Plug-ins

[Ayn]

It is possible to index it if you convert it to a non-binary format. There is no out-of-the-box solution that I know of for doing this however. Software such as barnyard may or may not support this by now, but last time I checked there was no specific output plugin for packet payloads in ASCII format. What Snort logs are you feeding Splunk with?

[Ayn]

Those are just the software versions. Snort can be configured to output various kinds of logs, as can barnyard. The most common scenario is to have Snort output a binary alert file and then have Barnyard read it, then using one or more output plugins to write the results in one way or another to files, databases etc. Looking at the most recent configuration options for barnyard, it seems the output module "log_ascii" may help you achieve what you want.

[gooza]

snort 2.9.0.5 , Barnyard 2.1.9