[Snort-openappid] [Snort-users] Appid question
Costas Kleopa (ckleopa)
ckleopa at ...5...
Mon Sep 19 11:07:23 EDT 2016
Adding the openappid snort list.
James, you’re probably looking for something like this training video.
In there it’s including some instructions on how to use the app-stats logs and get them exported using the u2streamer utility we have developed for this feature.
On Sep 18, 2016, at 8:51 PM, Russ Combs (rucombs) <rucombs at ...5...> wrote:
-------- Forwarded Message --------
Subject: [Snort-users] Appid question
Date: Sun, 18 Sep 2016 18:44:41 -0600
From: James Lay <jlay at ...45...><mailto:jlay at ...45...>
Reply-To: jlay at ...45...<mailto:jlay at ...45...>
To: Snort <snort-users at lists.sourceforge.net><mailto:snort-users at lists.sourceforge.net>
This afternoon I found myself mucking around with appid. I love appid. Right now it is only accompanying IDS hits. I was wondering if anyone has put something in place that makes appid almost like a....I want to say netflow, but not quite. I envision an app reading the appid.u2 file and dumping it to Elasticsearch. But instead of having only IDS hits, I'd like to try and have snort simply monitor and appid alert all traffic it sees. Has anyone done anything like this? Thanks.
<Attached Message Part.txt><Attached Message Part.txt>
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Snort-openappid