[Autogenerated] Welcome back to the course.
In the previous module we covered a few of the basic ways that we can expand
snorts capabilities through plugins integrations and add ons.
We'll take that all a step further in this module and discuss
some nuances around visualizing the data as well as optimizing
snort to start this conversation off.
The first pieces that allow us to really customize and
expand Snort is the output module.
This module gives us the ability to well output the data in some way.
Using the various modules here,
we can customize the formatting of the alerts and logs generated by the tool.
This occurs after the pre processors and detection engines
work their magic as you can see here there are several
different modules available for this.
We have the ability to generate syslog output writing alerts to a
file either fully or using the fast method TCP dump,
CSV and a few more.
Let's take a look at the syslog alerting for snort really quick
like typical syslog you can customize the logging facility code
and priority for the log messages.
Here's an example of how to configure this Here.
We have an alert configuration to send the syslog to our
elastic stack over ports 30 35 14 that's it.
As you can see we're calling the output module for alert.
Underscore syslog so snore knows which one to spin up the alert fast and alert.
Full modules give you the ability to control how much data
is logged and how efficiently as well.
The fast option doesn't write the full packet header
and it only writes to one file, making it more efficient.
The full alert module does in fact write the full
packet headers using this method,
Snort may have a performance impact unless using it with
extremely light traffic but with this you get a lot of
extra information in your alerts.
It's a tough balance.
Once you get the output set up,
you can ingest the data into a sim or other tool without any normalization,
like using log stash filters to add and modify fields.
Your data might not align with the sims data standards.
Normalization is crucial however,
you decide to do So here's an example of a general
search for the data from Snort,
as you can see the fields give us a lot of information for brevity.
You can't see them all, but we'll explore those in a real time in a little bit.
We can also see and control the fields in the way they're presented
from within Kibana this is a nice feature in the index pattern that
expands the usage of the Snort data.
You can modify the format and the labels for each one within here.
So they align with the use cases that you're needing the data for for example,
if our geolocation services were based on destination dot IP but we had
an event come in with a different field name for it,
then we would want to rename that field