[Snort-users] organizing snort logs into a usable format

Jon Quiros sysadmin at ...6132...
Sat Aug 3 01:34:02 EDT 2002

Paul Greene wrote:

> What is a good way to take raw snort logs and alert files and organize them
> into a usable format?
> i.e. sort logs by specific IP address, by frequency of attack, protocol, or
> whatever ...
> (probably a dumb question, but I only installed snort for the first time
> ever just a couple of weeks ago)
> PG

i think this is what you're referring to...
you can pour your data into a sql db (in the snort docs) and as far as front
ends, check out acid (http://www.cert.org/kb/acid/) and/or demarc
(www.demarc.com).  check out their licensing info.
i'm fairly new too but so far they've been very adequate.

Jon Q

More information about the Snort-users mailing list