Skip to content
This repository has been archived by the owner on Jan 18, 2024. It is now read-only.

Write Rule msg text to database with barnyard2 #240

Open
Penneke opened this issue Sep 19, 2018 · 0 comments
Open

Write Rule msg text to database with barnyard2 #240

Penneke opened this issue Sep 19, 2018 · 0 comments

Comments

@Penneke
Copy link

Penneke commented Sep 19, 2018

Hi, is there any configuration option/s for Barnyard2 that I can use to write to a db table the "msg" field defined for a rule when it triggers?Currently I am only able to save the Signature name text defined in the sid-msg.map and to write the alert text to a file. I know it would be possible to write the fields I want from the file to a db with a script but would be lovely to have it done by default by barnyard. Any ideas?

PD:
my current configuration to save data to db is:

output database: log, mysql, user=user password=password dbname=dbname host=host

And the alert msg content is different from the text defined for the signature of that alert sid (which I wrote in the sid-msg.map file):
100000222 || Fake sid text I just made up

alert any $FAKENET1 any -> $FAKENET2 FAKEPORT (msg:"THE MESSAGE I WANT TO BE IN DB TOO"; sid:100000222);

Thanks in advance.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant