Snort alert fast, barnyard2 output fast and Logstash

[Tarek Ben Soltane via Snort-users <snort-users () lists snort org>]

Dear All,
I hope you are doing great.

I have successfully configured Barnyard2 to write to mysql and then Base
picks up the information and displays correctly.

I have then decided to add the option "output alert_fast tofile" and send
that same file to Logstash. Barnyard2 is able to write correctly to that
file but when Logstash displays it, it is missing the "reference";
"classification", "gen-msg" and "sid-msg" of the rule used.

For example:
Here is a logstash output:
"[1:2010935:2] Snort Alert [1:2010935:2] [**] [Classification: Potentially
Bad Traffic] [Priority: 2] {TCP} X.X.X.X:52727 -> X.X.X.X:1433"


Now for Base, here is output for the same rule:
"ET POLICY Suspicious inbound to MSSQL port 1433"

It looks like barnyard2 doesn't read "reference"; "classification",
"gen-msg" and "sid-msg" files when it comes to "output alert_fast".

In the other hand, in Snort, if I use in command line option "-A fast", the
output is fine for Logstash.

Best regards,
Tarek

_______________________________________________
Snort-users mailing list
Snort-users () lists snort org
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette