View snort alerts outside of PFSense
-
We have a pair of Netgate devices running Snort and all the traffic from our main site runs through these devices and we monitor the Snort alerts through the PFSense interfaces on the two devices.
Shortly we will be deploying a significant number of other Netgate devices on our remote sites and we need to monitor the Snort alerts on those. We can't monitor 20+ snort windows and are looking for advice on the best way to feed the Snort alerts into a SIEM system? I've looked at the remote logging options within the interface but am unsure as to what to enable to get the snort logs into the external system.
-
Services -> Snort -> Barnyard2 -> Settings -> INTERFACE
Pop the IP address or FQDN of your SIEM system in the yellow box.
-
Thank you Nog, that's done the trick.
