I was just wondering if there was a parser available in the community
for broIDS logs? I haven't found anything in Live, aside from Snort
(which is also a great tool), but we're looking to use broIDS along
side. Anyone?
Hi, Looking for some input on how to make these sources come up as their
proper source. Basically we're pushing the events via syslog to SA from
RHEL, Solaris, and Linux environments (mixed environment, also have
Windows). In SA, the events get shuff...
I'm looking to parse DNS logs (query/answer) from our environment, and
am wondering if there's a parser that works for this? DNS -Verbose, and
DNS_verbose_lua exist in the Live feeds, but doesn't specify _if_ it
pulls from MS's dns.log. Our DNS is ha...
Is there a way to force SA to parse the source port in snort logs? As
you know, traffic looks like this; Jun 9 15:53:49 snortbox01
snort[123456]: [1:12345:6] SSH Activity Detected [Classification: Misc
activity] [Priority: 3]: {TCP}10.0.10.123:22 -> ...
The issue isn't present on current releases of AIO boxes. It only
happened on the first batch of boxes with version 10. I didn't keep the
script, as we didn't need to run it again. You should be able to find it
on SCOL.
We applied a fix to our partitions with support. They noted there was a
bug in the AIO appliance, fixed little over a year ago. The fix involved
running a script in CLI, which backed up the data, resized partitions,
and restored it once done. We no l...
We experienced a similar issue to this. Our metaDB was filling up past
95% disk space and wasn't able to roll the logs quickly enough,
resulting in the service crashing. What's your disk usage like? In the
CLI, do "df -lah" to see your usage.
