Appid question

[James Lay <jlay () slave-tothe-box net>]

Hey all,

This afternoon I found myself mucking around with appid.  I love appid.
 Right now it is only accompanying IDS hits.  I was wondering if anyone
has put something in place that makes appid almost like a....I want to
say netflow, but not quite.  I envision an app reading the appid.u2
file and dumping it to Elasticsearch.  But instead of having only IDS
hits, I'd like to try and have snort simply monitor and appid alert all
traffic it sees.  Has anyone done anything like this?  Thanks.

James

------------------------------------------------------------------------------

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!