Graylog extractor for suricata syslog messages

[deekdeeker]

Does anyone have a graylog extractor for suricata messages send to syslog? :)

[lfirewall1243]

i'm looking for it too

[mimugmail]

19.7 will bring better syslog support, hopefully this will fix this

[deekdeeker]

right now im using this grok pattern to help out.

%{WORD:ips}\[%{NUMBER:UNWANTED}\]: \[%{NUMBER:UNWANTED}:%{NUMBER:UNWANTED}:%{NUMBER:UNWANTED}\] %{DATA:description} \[Classification:%{DATA:classification}\] \[Priority: %{NUMBER:priority}\] \{%{WORD:protocol}\} %{IP:src_ip}:%{NUMBER:src_port} \-\> %{IP:dst_ip}:%{NUMBER:dst_port}

[lfirewall1243]

right now im using this grok pattern to help out.

%{WORD:ips}\[%{NUMBER:UNWANTED}\]: \[%{NUMBER:UNWANTED}:%{NUMBER:UNWANTED}:%{NUMBER:UNWANTED}\] %{DATA:description} \[Classification:%{DATA:classification}\] \[Priority: %{NUMBER:priority}\] \{%{WORD:protocol}\} %{IP:src_ip}:%{NUMBER:src_port} \-\> %{IP:dst_ip}:%{NUMBER:dst_port}

Thanks a lot !!! :)