Re: [Snort-users] xml plugins

Gustavo,

I usually recommend outputting to Unified output method. From there you can output it through barnyard to about any output module you'd like (BASE, Sguil, Syslog, tcpdump...)


Joel

On Mon, Jul 17, 2006 at 10:49:35AM +0200, Guillaume Vissian sent me:
> Thank you for your quick answer, but in reality the point which interest me
> in the xml plugin described by the CERT, was that i could send to another
> application the snort output (on the network...). Do you know anyway to do
> that ? In fact i have see that there is a socket output capacity, but there
> is no option and no docs about it
>
> Thanks by advance
>
> On 7/14/06, Gustavo Monteiro <gfmonteiro@gmail.com> wrote:
> >
> >Hi Guillaume,
> >
> >You could use a plugin for snort called IDMEF.
> >More information at http://sf.net/projects/snort-idmef.
> >
> >
> >
> >
> >
> >
> >
> >On 7/13/06, Guillaume Vissian <somebodyishere@gmail.com> wrote:
> >> Hi list,
> >>
> >> I'm currently trying to use the snort xml plugin but snort return an
> >error
> >> : plugin unknown ..... is there any option other that enable the library
> >> suggested on the cert website ?
> >> the --enable-xml option doesn't seems to be present ....
> >> has somebody test this plugin ?
> >>
> >> Thanks by advance for your help
> >>
> >> G.V.
> >>
> >>
> >>
> >-------------------------------------------------------------------------
> >> Using Tomcat but need to do more? Need to support web services,
> >security?
> >> Get stuff done quickly with pre-integrated technology to make your job
> >> easier
> >> Download IBM WebSphere Application Server v.1.0.1 based on Apache
> >Geronimo
> >> http://sel.as-us.falkag.net/sel?cmd=...057&dat=121642
> >>
> >>
> >> _______________________________________________
> >> Snort-users mailing list
> >> Snort-users@lists.sourceforge.net
> >> Go to this URL to change user options or unsubscribe:
> >> https://lists.sourceforge.net/lists/...fo/snort-users
> >> Snort-users list archive:
> >> http://www.geocrawler.com/redir-sf.p...st=snort-users
> >>
> >>
> >
> >
> >--
> >Gustavo Monteiro
> >

>
> -------------------------------------------------------------------------
> Using Tomcat but need to do more? Need to support web services, security?
> Get stuff done quickly with pre-integrated technology to make your job easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> http://sel.as-us.falkag.net/sel?cmd=...057&dat=121642

> _______________________________________________
> Snort-users mailing list
> Snort-users@lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/...fo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.p...st=snort-users

+---------------------------------------------------------------------+
Joel Esler Senior Security Consultant 1-706-627-2101
Sourcefire Security for the /Real/ World -- http://www.sourcefire.com
Snort - Open Source Network IPS/IDS -- http://www.snort.org
GPG Key: http://demo.sourcefire.com/jesler.pgp.key
AIM:eslerjoel YMSG:eslerjoel Gtalk:eslerj
+---------------------------------------------------------------------+


-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=...057&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users