Threat Level: green Handler on Duty: Xavier Mertens

SANS ISC: InfoSec Handlers Diary Blog - Internet Storm Center Diary 2015-02-07 InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Update to kippo-log2db.pl

Published: 2015-02-07
Last Updated: 2015-02-07 21:37:46 UTC
by Jim Clausing (Version: 1)
0 comment(s)

I discovered an issue with the tool I wrote about last June.  I've updated kippo-log2db.pl correcting an error where it was populating the sensor column of the session table improperly.  I discovered the error after loading some data into MySQL and then attempting to use Ion's kippo2elasticsearch script to move the data into ElasticSearch.  I've also discovered an anomaly that I have not yet taken up with the kippo author, why is the sensor colum in the session table int(4) when the id column of the sensor table is int(11)?  Since I only have a handful of sensors, it hasn't impacted me, but if you have an installation with a huge number of sensors, this could become a problem.  Anyway, get the new version and if you've imported data using the old version, you may need to reimport.  Sorry about that.

References:

http://handlers.sans.org/jclausing/kippo-log2db.pl

---------------
Jim Clausing, GIAC GSE #26
jclausing --at-- isc [dot] sans (dot) edu

Keywords: kippo tools
0 comment(s)
Diary Archives