Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.
3 replaced http://stackoverflow.com/ with https://stackoverflow.com/
source | link

I do not really like the idea of running multiple instances of snort. Note that as far as I remember snort is not a multi-threading detection engine. I think this solution will create a performance issue assume you have n numbers of rules set. Is this mean you will run n number of snort instances?

So, how can you do it? you need to use a log parser. So basically you let snort log all the alerts in a single log file. This file can be for example a ".csv" then using a simple log parser you can parse the file and create separate log files for each rule-set.

Is there any well know log parser tool that can parse snort logs?, Yes of course, If you are using windows then you can use Log Parser 2.2.

If you are using other platform for example Linux. You can simply use python to write a small script that parse the log. See this post for a sample codepost for a sample code.

Currently I am working on an IDS alerts correlation system. I can give you a small python script (part of my system) that do exactly what you want if you like?

I do not really like the idea of running multiple instances of snort. Note that as far as I remember snort is not a multi-threading detection engine. I think this solution will create a performance issue assume you have n numbers of rules set. Is this mean you will run n number of snort instances?

So, how can you do it? you need to use a log parser. So basically you let snort log all the alerts in a single log file. This file can be for example a ".csv" then using a simple log parser you can parse the file and create separate log files for each rule-set.

Is there any well know log parser tool that can parse snort logs?, Yes of course, If you are using windows then you can use Log Parser 2.2.

If you are using other platform for example Linux. You can simply use python to write a small script that parse the log. See this post for a sample code.

Currently I am working on an IDS alerts correlation system. I can give you a small python script (part of my system) that do exactly what you want if you like?

I do not really like the idea of running multiple instances of snort. Note that as far as I remember snort is not a multi-threading detection engine. I think this solution will create a performance issue assume you have n numbers of rules set. Is this mean you will run n number of snort instances?

So, how can you do it? you need to use a log parser. So basically you let snort log all the alerts in a single log file. This file can be for example a ".csv" then using a simple log parser you can parse the file and create separate log files for each rule-set.

Is there any well know log parser tool that can parse snort logs?, Yes of course, If you are using windows then you can use Log Parser 2.2.

If you are using other platform for example Linux. You can simply use python to write a small script that parse the log. See this post for a sample code.

Currently I am working on an IDS alerts correlation system. I can give you a small python script (part of my system) that do exactly what you want if you like?

2 edited body
source | link

I do not really like the idea of running multiple instances of snort. Note that as far as I remember snort is not a multi-threading detection engine. I think this solution will create a performance issue assume you have n numbers of rules set. Is this mean you will run n number of snort instances?

So, how can you do it? you need to use a log parser. So basically you let snort log all the alerts in a single log file. This file can be for example a ".csv" then using a simple log parser you can parse the file and create separate log files for each rule-set.

Is there any well know log parser tool that can parse snort logs?, Yes of course, If you are using windows then you can use Log Parser 2.2.

If you are using other platform for example Linux. You can simply use python to write a small script that parse the log. See this post for a sample code.

Currently I am working on an IDS alerts correlation system. I can gavegive you a small python script (part of my system) that do exactly what you want if you like?

I do not really like the idea of running multiple instances of snort. Note that as far as I remember snort is not a multi-threading detection engine. I think this solution will create a performance issue assume you have n numbers of rules set. Is this mean you will run n number of snort instances?

So, how can you do it? you need to use a log parser. So basically you let snort log all the alerts in a single log file. This file can be for example a ".csv" then using a simple log parser you can parse the file and create separate log files for each rule-set.

Is there any well know log parser tool that can parse snort logs?, Yes of course, If you are using windows then you can use Log Parser 2.2.

If you are using other platform for example Linux. You can simply use python to write a small script that parse the log. See this post for a sample code.

Currently I am working on an IDS alerts correlation system. I can gave you a small python script (part of my system) that do exactly what you want if you like?

I do not really like the idea of running multiple instances of snort. Note that as far as I remember snort is not a multi-threading detection engine. I think this solution will create a performance issue assume you have n numbers of rules set. Is this mean you will run n number of snort instances?

So, how can you do it? you need to use a log parser. So basically you let snort log all the alerts in a single log file. This file can be for example a ".csv" then using a simple log parser you can parse the file and create separate log files for each rule-set.

Is there any well know log parser tool that can parse snort logs?, Yes of course, If you are using windows then you can use Log Parser 2.2.

If you are using other platform for example Linux. You can simply use python to write a small script that parse the log. See this post for a sample code.

Currently I am working on an IDS alerts correlation system. I can give you a small python script (part of my system) that do exactly what you want if you like?

1
source | link

I do not really like the idea of running multiple instances of snort. Note that as far as I remember snort is not a multi-threading detection engine. I think this solution will create a performance issue assume you have n numbers of rules set. Is this mean you will run n number of snort instances?

So, how can you do it? you need to use a log parser. So basically you let snort log all the alerts in a single log file. This file can be for example a ".csv" then using a simple log parser you can parse the file and create separate log files for each rule-set.

Is there any well know log parser tool that can parse snort logs?, Yes of course, If you are using windows then you can use Log Parser 2.2.

If you are using other platform for example Linux. You can simply use python to write a small script that parse the log. See this post for a sample code.

Currently I am working on an IDS alerts correlation system. I can gave you a small python script (part of my system) that do exactly what you want if you like?