[Snort-users] Snort with Kiwi Sys Log

Greg Williams gwillia5 at ...15920...
Mon Mar 11 13:56:58 EDT 2013


That's a Kiwi filter if I remember correctly.  Personally I would use something like Splunk that gives you easy searching vs kiwi.  That way you also have historical data.

Greg Williams
IT Security Principal
University of Colorado at Colorado Springs
Website: http://www.uccs.edu/itsecure


-----Original Message-----
From: Jeremy Golden [mailto:goldenjc97 at ...11827...] 
Sent: Monday, March 11, 2013 11:41 AM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] Snort with Kiwi Sys Log

Hi, I am running snort on Windows 7 and just got kiwi to display traffic in its logs. How would I go about kiwi only display a single alert off of a specific rule? Does anyone have an example? 

I don't necessarily need all network traffic displayed, but rather create my own and have only it displayed. 

Any help would be great. 

Jeremy Golden
------------------------------------------------------------------------------
Symantec Endpoint Protection 12 positioned as A LEADER in The Forrester
Wave(TM): Endpoint Security, Q1 2013 and "remains a good choice" in the endpoint security space. For insight on selecting the right partner to tackle endpoint security challenges, access the full report. 
http://p.sf.net/sfu/symantec-dev2dev
_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!




More information about the Snort-users mailing list