Output Modules

147

4.2.6.1

Examples

Logging to a file  xmlout  on the local host:

output xml: log,   file=xmlout

The date and time will be appended to the name of the file so that data can be

saved for multiple Snort sessions.

Logging to a file  xmlout  on host snort.conformix.com using HTTP protocol:

output xml: alert, protocol=http  \

   host=snort.conformix.com file=xmlout

Logging to a file  xmlout  on host snort.conformix.com using HTTPS protocol:

output xml: alert, protocol=https \

  host=snort.conformix.com file=xmlout cert=conformix.crt \

  key=conformix.pem ca=ca.crt server=Conformix_server

Logging to a TCP server running on host snort.conformix.com and listening to

port number 5555:

output xml: alert, protocol=tcp \

   host=snort.conformix.com port=5555

Typical entries present in the output XML file:

      eth0

      192.168.1.2

      conformix.conformix.net

    ICMP Packet with TTL=100

    2002 07 23 17:48:31 04