Now that we understand how to run Snort and
activate additional inspector modules,
it's time to take a closer look at our output
options by briefly exploring loggers.
To state it simply,
logger modules are responsible for all event output within Snort.
Each one provides a different output format or file type,
including CSV, JSON, syslog, and yes,
even the fast output module we've been using throughout this
course. To get set up for the next module, we're going to focus
on configuring the alert_json logger.
Let's take a look at an example configuration. Like our other
modules, setting up alert_json is fairly simple.
Within the brackets is where we specify the fields we
want listed in our JSON alerts.
In this example,
we're telling Snort to output the protocol, source address
and port, destination address and port, the service, rule,
priority, class, and action.
This example also added Base64 data.
Now that we understand the purpose of logger modules and how to
configure alert_json, we're ready for the demo, where we'll activate
alert_json in preparation for our next module.