Re: Snort 3 (Individual Detection Alert and PCAP)

Hi Steve!

I'm sorry, but currently, it is not possible to achieve that. All loggers are designed to send alerts to a single output destination.
My only suggestion is to parse the output file in real-time and forward data into files according to your convenience.

Thanks,
Vitalii!

From: Snort-users <[email protected]> on behalf of steve via Snort-users <[email protected]>
Date: Monday, 9 September 2024 at 16:37
To: [email protected] <[email protected]>
Subject: [Snort-users] Snort 3 (Individual Detection Alert and PCAP)
Hi.

I realised Snort 3 appends alerts in one file "alert_full" or "alert_fast". The PCAPs are also appended under Log_pcap instead of individual pcaps for each detection.

i have read through snort_reference pdf and snort_user pdf. There isnt configuration or parameter i could set in snort.lua file.

Could any experts give some pointers on enabling one pcap for each detection alert and one txt file for each detection alert? Thank you.

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette