Re: Fwd: Snort 2.9.x ruletype logging output question

I already tried this config. (I think, this is almost same as my first 
config) Service starting without any error. But I can't see any alert of 
signature.


Fatih USTA

On 1.02.2022 17:13, Dorian ROSSE wrote:
> Try with this :
>
> ruletype my_alert {
> type alert
> output log_unified2 : filename snort_unified.log, limit 128
> output alert_syslog : LOG_AUTH LOG_ALERT
> }
>
> my_alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS(msg:"ET 
> WEB_SPECIFIC_APPS User Agent (SQLi Injection /Scanning)"; 
> flow:established,to_server; content:"User-Agent|3a20|testitest"; 
> http_header; 
> fast_pattern;reference:url,en.wikipedia.org/wiki/SQL_injection 
> <http://en.wikipedia.org/wiki/SQL_injection>;classtype:web-application-attack; 
> sid:2023351; rev:1;metadata:attack_target SQL_Server, created_at 
> 2016_10_19,deployment Datacenter, performance_impact Low, 
> signature_severityMajor, updated_at 2020_07_31;)
>
> I hope your success,
>
> Regards.
>
>
> Dorian Rosse.
> ------------------------------------------------------------------------
> *From:* Fatih USTA <[email protected]>
> *Sent:* Tuesday, February 1, 2022 2:59:36 PM
> *To:* Dorian ROSSE <[email protected]>; 
> [email protected] <[email protected]>
> *Subject:* Re: [Snort-users] Fwd: Snort 2.9.x ruletype logging output 
> question
>
> Hello,
>
> I copied and pasted into my config. But didn't worked.
>
>
> Unknown output plugin "unified2 log_unified2"
>
> Unknown output plugin "alert_syslog log_syslog"
>
> Fatal Error, Quitting..
>
>
> Output plugin is plugged in...
> -------------------------------------------------
>  Keyword     |          Output @
> -------------------------------------------------
> alert_syslog :       0x80ae428
> log_tcpdump  :       0x80b3d88
> alert_fast   :       0x80ad590
> alert_full   :       0x80adde4
> alert_unixsock:       0x80b2718
> alert_CSV    :       0x80b2c24
> log_null     :       0x80b3d18
> log_unified2 :       0x80b7496
> alert_unified2:       0x80b738a
> unified2     :       0x80b46dc
> log_ascii    :       0x80b7a30
> alert_sf_socket:       0x80b880c
> alert_sf_socket_sid:       0x80b8b83
> alert_test   :       0x80b92e8
> alert_fwsam  :       0x80af4c4
>
>
> Fatih USTA
> On 1.02.2022 15:20, Dorian ROSSE via Snort-users wrote:
>> Hello,
>>
>>
>> You forbid to log to a program with underscore then the program who 
>> is use as a log :
>>
>> For example with syslog :
>>
>> log_syslog
>>
>> Finally if unified and syslog are use as a logger your rule is typed 
>> like these :
>>
>> output unified2: filename snort_unified.log, limit 128
>>
>> ruletype my_alert {
>> type alert
>> output unified2 log_unified2 : filename snort_unified.log, limit 128
>> output alert_syslog log_syslog : log_auth log_alert
>> }
>>
>> my_alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS(msg:"ET 
>> WEB_SPECIFIC_APPS User Agent (SQLi Injection /Scanning)"; 
>> flow:established,to_server; content:"User-Agent|3a20|testitest"; 
>> http_header; 
>> fast_pattern;reference:url,en.wikipedia.org/wiki/SQL_injection 
>> <http://en.wikipedia.org/wiki/SQL_injection>;classtype:web-application-attack; 
>> sid:2023351; rev:1;metadata:attack_target SQL_Server, created_at 
>> 2016_10_19,deployment Datacenter, performance_impact Low, 
>> signature_severityMajor, updated_at 2020_07_31;)
>>
>> I hope success your problem,
>>
>> Regards.
>>
>>
>> Dorian Rosse.
>>
>> _______________________________________________
>> Snort-users mailing list
>> [email protected]  <mailto:[email protected]>
>> Go to this URL to change user options or unsubscribe:
>> https://lists.snort.org/mailman/listinfo/snort-users  <https://lists.snort.org/mailman/listinfo/snort-users>
>>
>> 	To unsubscribe, send an email to:
>> 	[email protected]  <mailto:[email protected]>
>>
>> Please visithttp://blog.snort.org  <http://blog.snort.org>  to stay current on all the latest Snort news!
>>
>> Please follow these rules:https://snort.org/faq/what-is-the-mailing-list-etiquette  <https://snort.org/faq/what-is-the-mailing-list-etiquette>

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette