[Oisf-users] Multiple Instances of Suricata for Different Outputs
Kerry.Milestone at ed.ac.uk
Thu May 11 13:29:21 UTC 2017
I wish to have different eve outputs for different groups yet all
heading to the same redis target, and onwards.
-o- with full URL or files, maybe extraction for certain hosts but not
-o- with full packet capture on alerts for some hosts/networks
-o- with SMTP extraction for specific grouped business units, but not others
-o- others things of current importance
With pfring, it shouldn't be too difficult to zero copy packets
efficiently to [kvm] separate machine running custom rulesets.
Is there a better way of doing this?
I've looked at the multi-tenant options, however splitting them out via
VLANs isn't a viable option.
Suggestions would be welcomed.
The University of Edinburgh is a charitable body, registered in
Scotland, with registration number SC005336.
More information about the Oisf-users