I have snort configured to log unified2 in my snort.conf file and am using barnyard2 to parse the unified2 results. It works, except I can seem to figure out to pull the event reference (xref) out of the data. I have my reference.config file with the different URLs and the sid-msg.map file has all the signature ids and the references within them, but can't seem to map them. I put the output to CSV to test and tried many different keywords, but no luck. Any ideas?
snort.conf ... output unified2: filename snort.u2, limit 128 ... barnyard2.conf (I've tried every word that I though might be the reference ID keyword, but nothing works) output alert_csv: /var/log/snort/csv.out timestamp,msg,srcip,sport,dstip,dport,classname,event_reference,xref,Xref,ref,event_xref,xref_uri