snort unified and unified2 log extraction

["Troy S. Jordan" <troyj () maine edu>]

Hello,

 Does anyone have any tools or methods for quickly extracting alerts +
packets from either unified or unified2 logs for a specific IP (src or
dest) ?

In my current workflow, I'd need to extract all the alerts to mysql via
barnyard2, and then search/extract the specific alerts as needed. This
works fine for 1 or 2 days worth of alerts, but doesn't scale for months
of data.

Any suggestions or pointers greatly appreciated.

- Troy

-- 

                           Troy Jordan, GCIH

                   t r o y j @ m a i n e . e d u

------------------------------------------------------------
                    Communications Specialist
                         Networkmaine
                 University of Maine System (UMS)
------------------------------------------------------------
233 Science Building               |     voice: 207.561.3590
Portland, ME 04103                 |     fax:   509.351.3650



------------------------------------------------------------------------------
This SF.net email is sponsored by Sprint
What will you do first with EVO, the first 4G phone?
Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users