README.csv

SPO_CSV Usage Guide Brian Caswell bmc@snort.org

$Id$

Overview:

The CSV output plugin gives an interface for users to specify what information they see for alerts. csv provides this by outputting the data in comma separated value format, configured by the user in the snort configuration file.

Using limited output configurations can greatly increase the speed of snort.

Usage:

The CSV output plugin can be configured to output specific portions of a snort alert.

spo_csv requires the following format.

output alert_CSV: location_to_your_file fieldname,fieldname2,fieldname3

The following line is an example CSV configuration: output csv: /my/snort.log msg,proto,timestamp,src,srcport,dst,dstport

That configuration will append the following output to /my/snort.log WEB-MISC phf access,TCP,02/23-11:06:59.600820 ,192.168.0.1,1021,192.168.0.2,80

Possible Field Names:

The following field names are available (As of 01/13/2004)

timestamp, sig_generator, sig_id, sig_rev, msg, proto, src, srcport, dst, dstport, ethsrc, ethdst, ethlen, tcpflags, tcpseq, tcpack, tcpln, tcpwindow, ttl, tos, id, dgmlen, iplen, icmptype, icmpcode, icmpid, icmpseq, and default

By specifying “default” as a field name, a default set of field names is used. grep DEFAULT_CSV spo_csv.h for the default set of fields