Is there a way to read multi-platform syslogs through Snort?
As you probably know,
is primarily a network
intrusion detection system
, designed to directly monitor a network for activity that matches certain patterns (the Snort ruleset). Unfortunately, it's really not a good tool for monitoring syslog traffic, because it's simply not designed for the task. However, there are a number of tools that can help analyze log data. If you're looking for a tool that helps perform offline analysis on the desktop, Sawmill is one of my favorites. Its major strength lies in its ability to tackle just about any log format you throw at it. If you want a system that provides real-time alerting, based upon syslog data, consider the open source Swatch (syslog watch) project. It's the "Snort of syslogs."
For More Information
Learn how to install, and configure Snort in this technical guide.
Visit our resource center for news, tips and expert advice on how to install and use open source security tools in your organization.
Dig deeper on Network Intrusion Detection (IDS)
Social media compliance is not typically considered a big issue for companies, but expert Mike Chapple explains why it should be.continue reading
Metadata tagging is not just for security. Expert Mike Chapple explains how tagging tools can be used to achieve PCI DSS compliance.continue reading
Before using the HIPAA-compliant cloud services from Google, there are some things companies need to know, according to expert Mike Chapple.continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.