Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I want to add more data to alert file. Right now the data that our analyst team sees is very minimal and we are not giving access to them to our snort backend server.
Our design is like centos /var/log/snort/alert mapped to kibana and if they want to see more data on attacks, how to provide them? I thought why not add packet payload details to the alert file or a little extra data to alert so the analyst can understand and block the IPs?
Adding external and third-party data to the alert file is not the right way to go. You want a tool to ingest the alert file and relate other data to the data from the alert file. This process is called "data enrichment".
If you start automatically editing the primary data store (the alert file) you risk corrupting the data. You want that data to remain intact and to enrich it in another environment.
