How can I modify the output alert from sfportscan ?

Ex : output alert_csv: /var/log/snort/portscan.log timestamp,src,dst,dstport,msg

OBS: I can set output for default alert file with this method ?

closed as off-topic by Xander, Neil Smithline, schroeder Sep 28 '15 at 20:29

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Xander, Neil Smithline, schroeder
If this question can be reworded to fit the rules in the help center, please edit the question.

  • All what I know is that you can. You will need to modify snort.conf. How ? I never did it. – user45139 Jul 29 '15 at 16:34
  • I need it for integrate with OSSEC ,if nobody show me a good answer i will developer a script :( – PypeRanger Jul 29 '15 at 16:40

I Developer a script for filter the sfportscan log and integrate it with OSSEC

SNORT(sfportscan) -> portscan.log < filter.py > portscan-filter.log < OSSEC Regex >

a = ""
f = open("/var/log/snort/portscan.log","r")
s = open("/var/log/snort/portscan-filter.log","w")
while 1:
    where = f.tell()
    line = f.readline()
    if line[:4] == "Time": a = line 
    elif "(portscan)" in line:
         a = a.replace("\n","")
         line = line.replace("\n","")
         ray = ','.join([a,line])
         print (ray) 
         a = ""

Output: Time: 01/02-12:34:56.006648 , -> (portscan) TCP Filtered Portscan

And i made this Regex for integrate with decode OSSEC rule: (\S+) ,(\d+.\d+.\d+.\d+) -> (\d+.\d+.\d+.\d+) (\(\w+\) .+)

Not the answer you're looking for? Browse other questions tagged or ask your own question.