[Snort-users] Snort and SQL database

Josh Bitto jbitto at ...16055...
Fri Feb 1 18:49:49 EST 2013


Yes Jeremy you are...no offense :P

In pfsense you can install the snort package and one of the dependencies would be barnyard2 which it installs automatically. Everything is setup for you so you don't have to edit any config files on the firewall. Barnyard has an already made up schema that you can copy and paste into your sql database. That's probably what I'm dealing with.



-----Original Message-----
From: Jeremy Hoel [mailto:jthoel at ...11827...] 
Sent: Friday, February 01, 2013 3:46 PM
To: Josh Bitto
Cc: Snort Users
Subject: Re: [Snort-users] Snort and SQL database

Well assuming PFSense is a firewall and reporting on every block/pass/whatever of traffic.. that will look completely different then a snort alert which only reports on traffic that hit against a rule; they are not the same thing.  You could have valid traffic all day long and never trigger an alert.. but the firewall logs might be busy logging all traffic.

But I could be missing the point of your question completely.



On Fri, Feb 1, 2013 at 11:22 PM, Josh Bitto <jbitto at ...16055...> wrote:
> I have after a week of battling with this finally got everything going on snort and then using barnyard2 to send the alerts to mysql.....However, when I export the data from the sql database it doesn't look the same at all as the report in pfsense....
>
> I used barnyard2's schema file to create the database and I'm not sure if that has something to do with it.
>
>
> Any suggestions?




More information about the Snort-users mailing list