How can I log attacks separately using snort. I basically want to log attacks invoked from different files separately. Like if I have 2 files, ddos.rules and log.rules, then I want logs generated from ddos.rules in one file and logs generated from log.rules in another.
Is it possible, and if so how can I do it?
Not directly, not in the way you want. You can specify multiple alert outputs, as described in the Section 2.6 of the manual. However, this will simply send the same alerts to multiple locations. You'll still have alerts from signatures imported from both ddos.rules and log.rules logged together.
Fear not, we can make it work. What you'll have to do is create multiple config files and have each log separately. Depending on exactly how you want to split up the traffic there are a couple of ways you can go.
Snort has a mechanism built-in to allow for processing different packet streams against different config files. This can be useful if you segment your applications based on network or VLAN. That is, all mail apps are on one VLAN, web servers on another, etc. The full details are provided in Section 2.10 of the manual, but the most relevant bits to understand are that it's dependent on VLAN or network, and there can be no duplicates. Meaning this is a valid configuration,
config binding: /etc/snort/snort.conf-ddos net 192.168.100.0/24
config binding: /etc/snort/snort.conf-log net 192.168.200.0/24
but this is not.
config binding: /etc/snort/snort.conf-ddos net 192.168.100.0/24
config binding: /etc/snort/snort.conf-log net 192.168.100.0/24
To use this feature in your situation you would have to run ddos.rules against one set of hosts and log.rules against another. I doubt you want to take this approach.
To date snort is single threaded so when processing is intense enough to utilize one complete processor it will begin dropping packets. Thanks to this you will often find snort sensors with several versions of snort running. Generally this works by using something called PF_RING, which is like a packet load balancer, or by chopping up your network space and running one version of snort per block. So one instance of snortd monitoring 192.168.1.0/25 and another watching 192.168.1.128/25. In most cases each process will use the same config file but just only watch certain addresses.
We can take that approach and turn it on it's head a bit to work in your situation. Let's create two config files and set the relevant portions thusly.
/etc/snort/snort.conf-ddos
output alert_syslog: LOG_LOCAL0 LOG_ALERT
include $RULE_PATH/ddos.rules
/etc/snort/snort.conf-log
output alert_syslog: LOG_LOCAL1 LOG_ALERT
include $RULE_PATH/log.rules
Then we set up your syslog engine, restarting it after making the change of course.
local0.alert /var/log/snort/alert-ddos.log
local1.alert /var/log/snort/alert-log.log
Now when you run snort you do it twice, each using the -c option. The first time we'll use -c /etc/snort/snort.conf-ddos and the second with -c /etc/snort/snort.conf-log.
Now you should have two instances of snortd running, one only with the ddos.rules signatures and logging to LOCAL0 and one with the log.rules signatures and logging to LOCAL1. As long as syslog is behaving you should have your alerts logging separately with no co-mingling.
Snort certainly supports multiple, simultaneous log targets. I think in your desired use case the possibility may hinge on your rulesets and how you want them to log. I have never done it this way and don't have a need/desire to.
Have a look at http://manual.snort.org/node21.html. This link details the Snort output options.
I do not really like the idea of running multiple instances of snort. Note that as far as I remember snort is not a multi-threading detection engine. I think this solution will create a performance issue assume you have n numbers of rules set. Is this mean you will run n number of snort instances?
So, how can you do it? you need to use a log parser. So basically you let snort log all the alerts in a single log file. This file can be for example a ".csv" then using a simple log parser you can parse the file and create separate log files for each rule-set.
Is there any well know log parser tool that can parse snort logs?, Yes of course, If you are using windows then you can use Log Parser 2.2.
If you are using other platform for example Linux. You can simply use python to write a small script that parse the log. See this post for a sample code.
Currently I am working on an IDS alerts correlation system. I can give you a small python script (part of my system) that do exactly what you want if you like?
