I have a snort log file in unified2 format and I am able to view the output using the u2spewfoo utility.
I think that I understand the generator id, signature id, and revision tell me why the alert was generated, but I'm not sure how to make sense out of them.
For instance, I have (sans packet data):
(Event)
sensor id: 0 event id: 3 event second: 1516750250 event microsecond: 585397
sig id: 527 gen id: 1 revision: 8 classification: 3
priority: 2 ip source: 0.0.0.0 ip destination: 255.255.255.255
src port: 68 dest port: 67 protocol: 17 impact_flag: 0 blocked: 0
mpls label: 0 vland id: 0 policy id: 0
I believe what I need is in the third line (sig id:). What does this tell me, and how do I map it to the rule which generated the event?
If it helps, I have a vanilla Debian installation with only the snort and snort-rules-default packages installed. The alert above was generated by processing a pcap file I had from a few months ago using the command:
snort -c /etc/snort/snort.conf -S HOME_NET=[192.168.1.0/24] -r daemonlogger.pcap.1516xxxxxx
This dumped several alerts to /var/log/snort/snort.log, which I then parsed with the u2spewfoo utility.