I would like to ask if there is a way to extract the log on snort.log.* and extract it to a Web interface. I know there is BASE, SGUIL, etc. However, I want a simple quick way of analyzing the traffic to include: Source, Destination, Payload, etc. Preferably in PERL.
The output log is the following:
-*> Snort! <*-
Version 1.8.7 (Build 128)
By Martin Roesch (roesch@sourcefire.com,
www.snort.org)
10/11-18:45:05.521560 192.168.0.144 -> 192.168.1.105
ICMP TTL:64 TOS:0x0 ID:0 IpLen:20 DgmLen:84 DF
Type:8 Code:0 ID:35330 Seq:0 ECHO
e.g. in plain text!
OUTPUT
Field Internal Name
source IP source_ip
destination IP destination_ip
source port source_port
destination port destination_port
classification classification
snort priority snort_priority
protocol protocol
rule rule
message message
Start Free Trial