I want to add more data to alert file rightnow the data what our analyst team see is very minimal and we are not giving access to them to our snort backend server, our design is like centos /var/log/snort/alert mapped to kibana and If they want to see more data on attacks how to provide them......I thought why not add packet payload details to alert file or little extra data to alert so analyst can understand and block the IPs.

| improve this question | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.