All Apps and Add-ons

is it possible to parse and index snort payload ?

gooza
Communicator

I'm trying to index snort data and I'm having problems with the payload since it is in hex/binary
anyone know if it possible to index the payload ?

0 Karma

jbsplunk
Splunk Employee
Splunk Employee

There is some pretty good documentation on this topic here:

http://commons.oreilly.com/wiki/index.php/Snort_Cookbook/Logging,_Alerts,_and_Output_Plug-ins

0 Karma

Ayn
Legend

It is possible to index it if you convert it to a non-binary format. There is no out-of-the-box solution that I know of for doing this however. Software such as barnyard may or may not support this by now, but last time I checked there was no specific output plugin for packet payloads in ASCII format. What Snort logs are you feeding Splunk with?

Ayn
Legend

Those are just the software versions. Snort can be configured to output various kinds of logs, as can barnyard. The most common scenario is to have Snort output a binary alert file and then have Barnyard read it, then using one or more output plugins to write the results in one way or another to files, databases etc. Looking at the most recent configuration options for barnyard, it seems the output module "log_ascii" may help you achieve what you want.

gooza
Communicator

snort 2.9.0.5 , Barnyard 2.1.9

0 Karma
Get Updates on the Splunk Community!

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...