Fat Winnie, a Syslog Relay dedicated to receiving Snort's Syslog alerts, sending them out through SMTP, and storing them in a MySQL database.
The following instruction shows how to tweak Snort in an effort to let it send out its alerts through Syslog protocol.
root@LinuxTest:~# snort -V
,,_ -> Snort! <- o" )~ Version 2.9.7.0 GRE (Build 149) '''' By Martin Roesch & The Snort Team: http://www.snort.org/contact#team Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. Copyright (C) 1998-2013 Sourcefire, Inc., et al. Using libpcap version 1.8.1 Using PCRE version: 8.39 2016-06-14 Using ZLIB version: 1.2.8
root@LinuxTest:~# cat /etc/rsyslog.conf|grep '.'|grep 514|grep -v '#'
. @192.168.0.1:514
root@LinuxTest:~# cat /etc/snort/snort_syslog.conf|grep syslog|grep -v '#'
output alert_syslog: host=192.168.0.1:514, LOG_LOCAL1 LOG_ALERT
root@LinuxTest:~# ps -aef|grep snort
root 8709 1 0 01:59 ? 00:00:02 /usr/sbin/snort -c /etc/snort/snort_syslog.conf -i eth0 -A full -D -s
P.S.: In this case, 192.168.0.1 is the remote syslogd server. Moreover, after everything above is set, rebooting the system is a must. Otherwise, the rsyslogd may not function properly.
The commands below presents the structure of the MySQL database being used.
mysql> CREATE DATABASE security;
mysql> CREATE TABLE threats (id INT NOT NULL AUTO_INCREMENT, s_time VARCHAR(20), sensor VARCHAR(20), engine VARCHAR(20), threat VARCHAR(200), classification VARCHAR(50), priority INT, protocol VARCHAR(11), srcip VARCHAR(20), srcport INT, dstip VARCHAR(20), dstport INT, PRIMARY KEY (id));
mysql> desc threats;
+----------------+--------------+------+-----+---------+----------------+
| Field | Type | Null | Key | Default | Extra |
+----------------+--------------+------+-----+---------+----------------+
| id | int(11) | NO | PRI | NULL | auto_increment |
| s_time | varchar(20) | YES | | NULL | |
| sensor | varchar(20) | YES | | NULL | |
| engine | varchar(20) | YES | | NULL | |
| threat | varchar(200) | YES | | NULL | |
| classification | varchar(50) | YES | | NULL | |
| priority | int(11) | YES | | NULL | |
| protocol | varchar(11) | YES | | NULL | |
| srcip | varchar(20) | YES | | NULL | |
| srcport | int(11) | YES | | NULL | |
| dstip | varchar(20) | YES | | NULL | |
| dstport | int(11) | YES | | NULL | |
+----------------+--------------+------+-----+---------+----------------+
12 rows in set (0.00 sec)