u2eve - Unified2 to Suricata eve events¶
Read unified2 log files and output events as Suricata EVE JSON (or as close as possible).
Usage¶
usage: idstools-u2eve [-h] [-C <classification.config>] [-S <msg-msg.map>]
[-G <gen-msg.map>] [--snort-conf <snort.conf>]
[--directory <spool directory>]
[--prefix <spool file prefix>] [--bookmark] [--follow]
[--delete] [-o <filename>] [--stdout]
[--packet-printable] [--packet-hex]
[filenames [filenames ...]]
positional arguments:
filenames
optional arguments:
-h, --help show this help message and exit
-C <classification.config>
path to classification config
-S <msg-msg.map> path to sid-msg.map
-G <gen-msg.map> path to gen-msg.map
--snort-conf <snort.conf>
attempt to load classifications and map files based on
the location of the snort.conf
--directory <spool directory>
spool directory (eg: /var/log/snort)
--prefix <spool file prefix>
spool filename prefix (eg: unified2.log)
--bookmark enable bookmarking
--follow follow files/continuous mode (spool mode only)
--delete delete spool files
-o <filename>, --output <filename>
output filename (eg: /var/log/snort/alerts.json
--stdout also log to stdout if --output is a file
--packet-printable add packet_printable field to events
--packet-hex add packet_hex field to events
If --directory and --prefix are provided files will be read from the specified
'spool' directory. Otherwise files on the command line will be processed.
Example - View a unified2 file as eve¶
idstools-u2eve -C path/to/classification.config \
-S /path/to/sid-msg.map \
-G /path/to/gen-msg.map merged.log.1431384519
Example - Continuous conversion to eve¶
idstools-u2eve --snort-conf /etc/snort/etc/snort.conf \
--directory /var/log/snort \
--prefix unified2.log \
--follow \
--bookmark \
--delete \
--output /var/log/snort/alerts.json \
The above command will operate like barnyard, reading all unified2.log files in /var/log/snort, waiting for new unified2 records when the end of the last file is reached.
Additionally the last read location will be bookmarked to avoid reading events multiple times, the unified2.log files will be deleted once converted to JSON, and JSON events will be written to /var/log/snort/alerts.json.
Configuration File¶
A configuration file is simply a file containing the command line arguments, one per line with an ‘=’ separating the name from the argument. For example, to save the arguments used in example 2 above:
--snort-conf=/etc/snort/etc/snort.conf
--directory=/var/log/snort
--prefix=unified2.log
--follow
--bookmark
--delete
--output=/var/log/snort/alerts.json
Then call idstools-u2eve like:
idstools-u2eve @/path/to/config-file
Addtional arguments can also be provided like:
idstools-u2eve @/path/to/config-file --stdout