Re: snort unified and unified2 log extraction

[Joel Esler <jesler () sourcefire com>]

On Jul 15, 2010, at 10:02 AM, Troy S. Jordan wrote:
> Hello,
>
> Does anyone have any tools or methods for quickly extracting alerts +
> packets from either unified or unified2 logs for a specific IP (src or
> dest) ?
>
> In my current workflow, I'd need to extract all the alerts to mysql via
> barnyard2, and then search/extract the specific alerts as needed. This
> works fine for 1 or 2 days worth of alerts, but doesn't scale for months
> of data.
>
> Any suggestions or pointers greatly appreciated.

Give this a shot Troy.

http://code.google.com/p/snort-unified-perl/

Joel

------------------------------------------------------------------------------
This SF.net email is sponsored by Sprint
What will you do first with EVO, the first 4G phone?
Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users