Unified output readers for Snort

An introduction to Barnyard, a popular unified output reader.

Probably the most popular unified output (or spool) readers is Barnyard. Barnyard hasn't been updated in several years, but it continues to work. The following built-in help reveals some of its capabilities.

Just as the Syngress Snort book is the definitive reference on unified output, the same books are authoritative for Barnyard. The purpose of this article is to show how the unified output can be transformed into something more analyst-friendly.

Barnyard supports a variety of output plugins. If you read my previous article, then many of these will be familiar:

  • alert_fast
  • log_dump
  • alert_csv
  • alert_syslog
  • alert_syslog2
  • log_pcap
  • alert_acid_db
  • log_acid_db
  • sguil

First I'll demonstrate all of these except the ACID and Sguil plugins. I create a barnyard.conf file with the following:

config hostname: cel433
config interface: dc0
config filter: 

output alert_fast: alert_fast.by
output log_dump: log_dump.by
output alert_csv: /tmp/so/by/alert_csv.by
output alert_syslog
output alert_syslog2
output log_pcap: log_pcap.by

Next I test how Barnyard will process snort.alert.TIMESTAMP in batch mode using Barnyard's -R switch.

That looks good to me.


Working with unified output

  Introduction
  Examining unified output
  Unified output readers
  Barnyard processing alerts
  Barnyard processing logs
  Barnyard working with databases

About the author
Richard Bejtlich is founder of TaoSecurity, author of several books on network security monitoring, including Extrusion Detection: Security Monitoring for Internal Intrusions, and operator of the TaoSecurity blog.

This was first published in July 2007

Dig deeper on Network security products, technologies, services

Pro+

Features

Enjoy the benefits of Pro+ membership, learn more and join.

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

-ADS BY GOOGLE

MicroscopeUK

SearchCloudProvider

SearchSecurity

SearchStorage

SearchNetworking

SearchCloudComputing

SearchConsumerization

SearchDataManagement

SearchBusinessAnalytics

Close