Hands-On Network Forensics

IDS logs

Let's make use of Sawmill again, this time to parse snort logs:

1. We will select Create New Profile, which will result in the following:

2. Select Snort logs and then press Next, which will show us the log-detection process:

3. On successfully detecting the log type, we will get the following options:

4. Select Sourcefire Snort 2 format ...