Re: Snort 3 (Individual Detection Alert and PCAP)

Hi

Not sure about the use case, but for alerts it is possible to log every event into a separate file. Using Lua.

A good starting point is https://github.com/snort3/snort3_extra/blob/master/src/loggers/alert_lua/alert.lua
The printing function is modified in the following way:

-- rotate file names
file_name_idx = 0
file_base_name = "alerts.txt."

-- alert() is required
function alert ()
    -- get luajit structs
    local evt = ffi.C.get_event()
    local pkt = ffi.C.get_packet()

    -- str is a luajit string
    local str = ffi.string(evt.msg)

    -- create a file, print the event, close it
    file_name_idx = file_name_idx + 1;
    local file_name = file_base_name .. file_name_idx
    file = io.open(file_name, "w")

    file:write(string.format('%d:%d:%d %s', evt.gid, evt.sid, evt.rev, str))

    file:close()
end


Now we can get alerts printed into a new file each time:

  *   place alert.lua in a directory with plugins (assuming it's a local directory)
  *   and run snort with the following command line options: --script-path . -A lualert


Best wishes,
Alexey

On 24 Sep 2024, at 12:41, Vitalii Serhiiovych Horbatov -X (vhorbato - SOFTSERVE INC at Cisco) via Snort-users <[email protected]> wrote:

Hi Steve!

I'm sorry, but currently, it is not possible to achieve that. All loggers are designed to send alerts to a single output destination.
My only suggestion is to parse the output file in real-time and forward data into files according to your convenience.

Thanks,
Vitalii!

From: Snort-users <[email protected]> on behalf of steve via Snort-users <[email protected]>
Date: Monday, 9 September 2024 at 16:37
To: [email protected] <[email protected]>
Subject: [Snort-users] Snort 3 (Individual Detection Alert and PCAP)
Hi.

I realised Snort 3 appends alerts in one file "alert_full" or "alert_fast". The PCAPs are also appended under Log_pcap instead of individual pcaps for each detection.

i have read through snort_reference pdf and snort_user pdf. There isnt configuration or parameter i could set in snort.lua file.

Could any experts give some pointers on enabling one pcap for each detection alert and one txt file for each detection alert? Thank you.
_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

To unsubscribe, send an email to:
[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette