So far,
Globomantics has been very pleased with our progress in getting
Snort up and running to detect potential threats to our network,
but they have a new request for us.
Globomantics is looking at different tools that can display Snort's
information in a better visual format for them.
Some of their options take input from a file in JSON format,
and they want to know if Snort is capable of providing this.
When you tell them it will be easy for them to get that output,
they ask you to configure Snort to output in JSON format for a demonstration.
Let's head over to our Snort server and get started. To
configure our test case, let's add the example configuration
into our Snort configuration file. To enable the JSON alert
type, we need to type that command,
followed by an equal sign and then our brackets.
Within the brackets,
we need to add four spaces followed by fields, an equal
sign, and then the fields we want to specify. Let's go with
the protocol, source address, source port, destination address,
destination port, service rule priority class action,
and Base64 data, like the example.
Once we have our configuration in place, we just need to
save the file and then run Snort. To run Snort and produce
a JSON file with our alerts,
we need to make a couple of changes to our command line.
We first need to change the alert format from Fast to JSON.
We also need to add a ‑q to suppress the initial information and then
specify a file to output to. In this case, we'll simply use
alerts.json. To populate that file, I'm going to run another noisy
port scan using nmap from our Kali Linux VM. We'll wait a little
while for the alerts to populate our file, and then go ahead and stop
the scan and Snort.
Now let's check the file and make sure we have JSON output.
Sure enough,
we have our alerts in JSON format, ready to be ingested in
Globomantics' chosen tool. For a quick recap, we enabled the
alert_json module and specified fields that we want to obtain in
the Snort configuration file.
We modified our Snort command to output to JSON in quiet mode and sent the
output to a file called alerts.json. We confirmed the successful
configuration by running a port scan to generate alerts and verifying that
the alerts file was populated with alert information in JSON format,
meeting Globomantics' requirement.