Video Screencast Help

SSIM 4.7 + Sourcefire eStreamer

Created: 13 Nov 2012 | 3 comments

Hi all,

I've been swapping the Snort Syslog connector for the Sourcefire eStreamer for our sourcefire environment.

My main reason is the collection of network packets from the IDS environment.
When looking into the events received, i don't see any network packet information, any of you have an idea how to get this done ?



Comments 3 CommentsJump to latest comment

Laurent_c's picture

The Source Fire collector doesn't collect the Data Payload if it is what you are looking for.

Dorbian's picture

Hi Laurent,


There is no way to configure the collector to get that data in one of the custom fields ?



Laurent_c's picture

Well this is how the collector was written. To be able to collect the payload, it will need to be changed (either code or/and sensor) to colelct payload from the sourcefire db.

This is a good enhancement request.