#4 How To Parse Snort IDS Logs in Graylog | Free Log Management And Visualization Course

In this video i will show you how to extract data fields from Snort logs in Graylog.

This is the guide that i followed:

And this is the rule that i used:

[aldehc]

Awesome tutorial, thanks for sharing this useful info.

[carlosmagalhaes]

Snort Regex not working


If I look at the Snort messages coming through I have this format from Pfsense: IP ADDRESSES removed with x.x.x.x


filterlog:
snort[42549]: [3:21355:5] PROTOCOL-DNS potential dns cache poisoning attempt - mismatched txid [Classification: Attempted Information Leak] [Priority: 2] {UDP} x.x.x.x:53 -> x.x.x.x:41544


Not running anything special on the Pfsense snort settings so should be default syslog settings (logging to syslog).


Any ideas?

[ITSecurityLabs]

This is the rule that i used, copy and paste it:


rule "Extract Snort alert fields"
when
has_field("message")
then
let m = (.+?) \\[Classification: (.+?)\\] \\[Priority: (\\d+)]: \\<(.+?)\\> \\{(.+?)\\} (\\d{1, 3}\\.\\d{1, 3}\\.\\d{1, 3}\\.\\d{1, 3})(:(\\d{1, 5}))? -> (\\d{1, 3}\\.\\d{1, 3}\\.\\d{1, 3}\\.\\d{1, 3})(:(\\d{1, 5}))?\\R?",

set_field("snort_alert", true);

set_field("generator_id", m["0"]);
set_field("signature_id", m["1"]);
set_field("signature_revision_id", m["2"]);

set_field("description", m["3"]);
set_field("classification", m["4"]);
set_field("priority", to_long(m["5"]));
set_field("protocol", m["7"]);

set_field("src_addr", m["8"]);
set_field("src_port", to_long(m["10"]));

set_field("dst_addr", m["11"]);
set_field("dst_port", to_long(m["13"]));
end

[trieutrinh]

Thanks you, you can show topology network and where is graylog install, on snort or another VM?

[sabc]

hello good video, but my query is the snort installed on the same graylog server?

[johnmarren]

I am looking for the link where you discuss setting up pfSense with Snort. could you provide the link?

[pingpongtrading]

Hi I am not able to get the pfsense pipeline working linked to the stream pfsense. It works fine against all messages, but it stops against pfsense and the real_timestamp is not added in that case any clue?

[towesc]

Thanks man, looking forward to see the pfsense firewall logs (:

[erra]

your regex that you put in description link has errors too

[chathurangabw]

Application_name is not showing in stream rules . what should i do ?

[ilhamhidayattk]

thank you, how configure system inputs :(

[AlexanderNordb]

Rule is not working, neither does the rule from greylog's documentation. Pretty sure this is a dead topic.
FYI: Next time you should use hastebin or something to paste code as the link you provided from the rule used in the vid has a messed up formatting. Also the rule displayed on your link does not look to be the same from the video.

[theeeno]

could you provide the updated rule source code for graylog?

[leviethung]

I have some problem with pushing snort log to graylog
Can you help me, please?
Thanks