Skip to content

Snort integration -- test LLM generation with service_info #16075

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Snort integration -- test LLM generation with service_info #16075

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
93beb4c
test LLM generation with service_info
alaudazzi Nov 21, 2025
7ab16a2
Run elastic-package build
alaudazzi Nov 21, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
133 changes: 124 additions & 9 deletions packages/snort/_dev/build/docs/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,15 +1,130 @@
# Snort Integration
# Snort Integration for Elastic

This integration is for [Snort](https://www.snort.org/).
## Overview

## Compatibility
The Snort integration for Elastic collects logs from Snort, a leading open-source Intrusion Prevention System (IPS). It allows for the monitoring of network traffic in real-time to detect security threats, policy violations, and unauthorized access attempts. By collecting and analyzing Snort logs, this integration provides crucial insights for threat detection, network traffic analysis, and compliance monitoring.

This module has been developed against Snort v2.9 and v3, but is expected to work
with other versions of Snort. This package is designed to read from the PFsense CSV output,
the Alert Fast output either via reading a local logfile or receiving messages via syslog and the Snort 3 JSON log file.
This integration facilitates:
- Real-time visibility into network activity and potential threats.
- Enhanced security operations through detailed alert analysis.
- Forensic analysis and performance monitoring by capturing network packets.

## Log
### Compatibility

{{event "log"}}
This integration has been developed against Snort v2.9 and v3, but is expected to work with other versions. It supports logs from various operating systems where Snort can be installed, including multiple Linux distributions, BSD variants (OpenBSD, FreeBSD, NetBSD), Solaris, macOS, and others.

{{fields "log"}}
The following log formats are supported:
- PFsense CSV output
- Alert Fast output (from logfile or syslog)
- Snort 3 JSON log file

This integration is compatible with Elastic Stack versions `^8.11.0 || ^9.0.0`.

### How it works

The integration collects logs from Snort instances in two ways:
1. **Log file monitoring**: The Elastic Agent can be configured to read logs directly from Snort's output log files.
2. **Syslog**: Snort can be configured to send logs to a syslog server, and the Elastic Agent can listen for these logs on a specified UDP port.

Once collected, the logs are parsed and enriched with relevant metadata before being indexed in Elasticsearch.

## What data does this integration collect?

The Snort integration collects log messages containing information about network traffic, including:
* Network packets
* Alerts on suspicious activity
* Network session information
* Protocol analysis data

### Supported use cases

- **Intrusion Detection System (IDS):** Monitor network traffic in real-time to detect unauthorized access attempts, policy violations, and other security threats.
- **Intrusion Prevention System (IPS):** Actively block detected threats to prevent potential damage to the network.
- **Packet Sniffing and Logging:** Capture and analyze network packets for troubleshooting, performance monitoring, and forensic analysis.
- **Network Traffic Analysis:** Analyze network traffic to identify malicious patterns and anomalies.
- **Compliance Monitoring:** Ensure adherence to security policies and regulatory requirements by detecting unauthorized access attempts and other security violations.

## What do I need to use this integration?

- **Snort Installation**: A running instance of Snort is required.
- **Dependencies**: Ensure that required libraries, such as `libpcap`, are installed on the system running Snort.
- **User Privileges**: Administrative or root privileges are necessary for the installation and configuration of Snort.

## How do I deploy this integration?

### Agent-based deployment

Elastic Agent must be installed to collect logs and send them to the Elastic Stack. For more details, check the Elastic Agent [installation instructions](docs-content://reference/fleet/install-elastic-agents.md). You can install only one Elastic Agent per host.

### Onboard / configure

#### 1. Configure Snort

1. **Install Snort**: If not already installed, download the latest version from the [official website](https://www.snort.org/) and follow the installation instructions for your operating system.
2. **Configure `snort.conf`**: Edit the `snort.conf` file to set network variables, define rule paths, and configure output plugins.
3. **Configure Log Output**: To send logs to the Elastic Stack, configure Snort to either write to a log file or send logs via syslog.
* **For log file collection**: Ensure the `output alert_fast` or other logging configurations in `snort.conf` write to a predictable file path that the Elastic Agent can access.
* **For syslog collection**: Configure Snort to send logs to the host and port where the Elastic Agent is listening.
4. **Test Configuration**: Run Snort in test mode to validate the configuration:
```
snort -T -c /path/to/snort.conf
```
5. **Start Snort**: Start Snort to begin monitoring network traffic.

#### 2. Configure the Elastic Integration

1. In Kibana, go to **Management > Integrations**.
2. Search for "Snort" and click on it.
3. Click **Add Snort**.
4. Configure the integration with the appropriate settings. Choose the input type based on your Snort configuration:
* For **logfile collection**, provide the path to the Snort log file (e.g., `/var/log/snort/alert.log`).
* For **syslog collection**, specify the UDP host and port the Elastic Agent should listen on.
5. Click **Save and continue**. This will install the necessary assets, such as dashboards and ingest pipelines, and deploy the configuration to the Elastic Agent.

### Validation

1. **Generate Test Traffic**: Use a tool like `nmap` to simulate network scans or other activities that should trigger Snort alerts.
2. **Check Snort Logs**: Review Snort's alert logs to confirm that the test activities were detected and logged.
3. **Verify in Kibana**: In Kibana, navigate to the **Discover** tab and search for `data_stream.dataset: "snort.log"`. The alerts should appear in Kibana, confirming end-to-end data flow. You can also check the Snort dashboards for visualizations of the data.

## Troubleshooting

For help with Elastic ingest tools, check [Common problems](https://www.elastic.co/docs/troubleshoot/ingest/fleet/common-problems).

**Common Snort Configuration Issues:**

- **Issue**: Snort fails to start due to configuration errors.
- **Solution**: Run Snort in test mode (`snort -T -c /path/to/snort.conf`) to identify and resolve configuration issues.

- **Issue**: No alerts are being generated.
- **Solution**: Ensure that Snort is monitoring the correct network interface and that relevant rules are enabled in your `snort.conf`.

For more information, refer to the official [Snort Documentation](https://www.snort.org/documents).

## Scaling

For high-traffic environments, deploying Snort in a distributed architecture with multiple sensors can help balance the load and improve detection capabilities.

For more information on architectures that can be used for scaling Elastic ingest, check the [Ingest Architectures](https://www.elastic.co/docs/manage-data/ingest/ingest-reference-architectures) documentation.

## Reference

### log

The `log` data stream collects all log types from Snort.

#### log fields

{{ fields "log" }}

#### log sample event

{{ event "log" }}

### Inputs used

{{ inputDocs }}

### API usage

This integration does not use any external APIs.
Loading