Re: snort unified and unified2 log extraction

[Jason Brvenik <jasonb () sourcefire com>]

Check put my perl modules for unified handling, it is what I initially
wrote it for.

http://code.google.com/p/snort-unified-perl/

On Thu, Jul 15, 2010 at 10:02 AM, Troy S. Jordan <troyj () maine edu> wrote:
> Hello,
>
>  Does anyone have any tools or methods for quickly extracting alerts +
> packets from either unified or unified2 logs for a specific IP (src or
> dest) ?
>
> In my current workflow, I'd need to extract all the alerts to mysql via
> barnyard2, and then search/extract the specific alerts as needed. This
> works fine for 1 or 2 days worth of alerts, but doesn't scale for months
> of data.
>
> Any suggestions or pointers greatly appreciated.
>
> - Troy
>
> --
>
>                           Troy Jordan, GCIH
>
>                   t r o y j @ m a i n e . e d u
>
> ------------------------------------------------------------
>                    Communications Specialist
>                         Networkmaine
>                 University of Maine System (UMS)
> ------------------------------------------------------------
> 233 Science Building               |     voice: 207.561.3590
> Portland, ME 04103                 |     fax:   509.351.3650
>
>
>
> ------------------------------------------------------------------------------
> This SF.net email is sponsored by Sprint
> What will you do first with EVO, the first 4G phone?
> Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users



-- 
Regards,

Jason.

------------------------------------------------------------------------------
This SF.net email is sponsored by Sprint
What will you do first with EVO, the first 4G phone?
Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users