3 Replies Latest reply on Aug 17, 2015 2:59 PM by rbroom

    Nitro SIEM not showing IP addresses from Snort  / Barnyard2

    rbroom

      I am adding new Snort sensors to a Nitro Receiver, and no IP addresses are appearing in the ESM console.  Events are appearing, but with "::" as the source and destination IPs.  If I view the packets, they show up with IP addresses.  If I view the log entries, they only show "::" where the IPs should be.

       

      Has anyone seen or solved this problem?

       

      I've confirmed that Snort is logging the IPs in the event data on the source (Unified2 format).  I've patched Barnyard2 to enable Nitro output, and am sending both alert_nitro and log_nitro to the receiver.

       

      I have an old, legacy snort sensor that IS reporting correctly.  I daren't tamper with it lest it stop working, but I've copied its source and configs to a new machine without success.  I'm wondering if there's something wrong when Nitro creates a new source on the receiver.

       

      I've had a support ticket open for four weeks, but there's been no solution so far.  I'm trying to get to the barnyard2 patch author for assistance.

       

      Nitro Version: 9.5.0 20150305

      Snort version: 2.9.7.0 Build 149

      Barnyard2 version: 2.1.9 Build 263 (the only one I'm aware of that works with the Nitro output patch)

       

      Many thanks for any suggestions or solutions.