SignatureMap error about py-idstools HOT 8 CLOSED

Any chance you can share your gen-msg.map and community-sid-msg.map? I think I see the issue, but just want to be sure.

from py-idstools.

The *.map files are the default ones after a fresh apt-get install snort with no updates (pulled pork).
These are the gists:
https://gist.github.com/cleesmith/f8ffce5e444983d98241
https://gist.github.com/cleesmith/b0f261ac8abd8af32287

Thanks for idstools as I am trying to use it to feed events directly into elasticsearch and bypass
the current very slow process of reading them out of mysql (barnyard2) and indexing into
elasticsearch.

I also had some errors reading old unified2 files, but I'll have to get back to you when I can find
those files again.

from py-idstools.

Fixed in git master. It was failing while loading the community-sid-msg.map file. Now you should be able to print(sigmap.get(1, 100000934)) and see some proper output.

from py-idstools.

Thanks :) ... so I need to clone, or just edit maps.py, and wait until later for a pip install ?

from py-idstools.

I tossed a 0.4.2 up on PyPi, so you should be able to get it with pip now.

from py-idstools.

Thanks it works now ... one step closer to indexing in elasticsearch.

from py-idstools.

Ahh cool. I've been working on the same thing. py-idstools has a bit of a oinkmaster/pulledpork clone in it, and indexing rules into elastic search is something I've been working on to make rules available to my own EveBox tool.

from py-idstools.

I have several projects (ruby/rails) that offer a UI for snort events both in mysql
and elasticsearch. It's just very slow to index into elasticsearch via the 'ancient' snort mysql schema/tables using a trigger, so a more direct way is needed to bypass mysql (or any barnyard2 db). I'm hoping that idstools is fast enough to help with indexing.

from py-idstools.