Snort mailing list archives
Re: Snort and ARIS Extractor
From: Erek Adams <erek () theadamsfamily net>
Date: Wed, 24 Oct 2001 07:38:22 -0700 (PDT)
On Wed, 24 Oct 2001, Mike Walter wrote:
I am sure someone has covered this, but I can't seem to find it. I downloaded and registered with ARIS so I could upload my logs. I am logging to mySQL, and thought I could just use the portscan.log with the ARIS extractor. This does not seem to be the case. How do I log snort to mySQL and to the proper file format so I could run the ARIS extractor? Thanks in advance.
Two options that I can come up with. 1) Use Barnyard, which is still in beta, to dump from the unified logging format into the DB. 2) Configure fast or full alerts _along with_ the DB output. Snort can dump to two logging formats at the same time. Just don't try this on a Fat Pipe(tm). You could also do post-processing of the data if you wanted--log to binary and mysql, then come back over that at the end of the night to dump out the full/fast alerts. Hope that helps! ----- Erek Adams Nifty-Type-Guy TheAdamsFamily.Net _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snort and ARIS Extractor Mike Walter (Oct 24)
- Re: Snort and ARIS Extractor Erek Adams (Oct 24)
- Re: Snort and ARIS Extractor Demetri Mouratis (Oct 24)
- <Possible follow-ups>
- Re: Snort and ARIS Extractor Peter Bates (Oct 24)
- RE: Snort and ARIS Extractor Mike Walter (Oct 24)
- RE: Snort and ARIS Extractor Peter Bates (Oct 25)