Release Details
Fields |
Details |
---|---|
Name |
Snort |
Version |
5.0.0 |
Supported On |
LogPoint v6.0.0 and later |
Release Date |
2020-05-14 |
Document Date | 2020-05-14 |
Download | Snort_5.0.0.pak |
SHA256 |
ce0b0a4c29865c53507f3fcf769375e77b3ddd1c05a1fe9b756be5af24e4acb7 |
Package Details
The application consist of the following components:
- Dashboard Package
- LP_Snort
- Label Package
- LP_Snort
- Normalization Package
- LP_Snort
Important Notice
All the normalized field names used in this application are checked and aligned with the LogPoint taxonomy.
Enhancement
A minor update has been done in the application’s normalizer for better signature handling.
General Description
The Snort application normalizes Snort events and enables you to analyze Snort data using pre-set dashboard views. You can further customize the dashboard and searches to perform in-depth analysis.
Installation
Follow these steps to install the Snort v5.0.0 plugin:
- Download the Snort package from the Download section above.
- Add the required Snort as a device in LogPoint.
- Create a collection policy with the Syslog collector and appropriate processing policy.
- Assign the policy to the device.
- Add the dashboard.
Supported Devices
The supported devices of Snort with LogPoint in this configuration are:
- Snort v2.x
Log Format
Expected Log Source
Snort
Log Sample
<38>Oct 23 06:36:25 snort snort[6153]: [139:1:1] (spp_sdf) SDF Combination Alert [Classification: Sensitive Data was Transmitted Across the Network] [Priority: 2] {TCP} 1.1.1.1 -> 1.1.1.2
To export data to LogPoint use Syslog collector on port 514 on the LogPoint server.
Support
If you have any queries or require assistance, please feel free to contact our support team:
Email: servicedesk@logpoint.com
Phone: +45 7060 6100
Best regards,
Comments
Article is closed for comments.