[Snort-users] organizing snort logs into a usable format
sysadmin at ...6132...
Sat Aug 3 01:33:03 EDT 2002
Paul Greene wrote:
> What is a good way to take raw snort logs and alert files and organize them
> into a usable format?
> i.e. sort logs by specific IP address, by frequency of attack, protocol, or
> whatever ...
> (probably a dumb question, but I only installed snort for the first time
> ever just a couple of weeks ago)
i think this is what you're referring to...
you can pour your data into a sql db (in the snort docs) and as far as front
ends, check out acid (http://www.cert.org/kb/acid/) and/or demarc
(www.demarc.com). check out their licensing info.
i'm fairly new too but so far they've been very adequate.
More information about the Snort-users