SnoGE

Yes the name is new, and the code is updated.

Mike Guiterman persuaded me to take part in a Snort Users webex “Pimp My Snort”, this gave me a great excuse to update and document my old snort / google earth mash-up. I am now happy to present “SnoGE” (pronounced snoog-ie). An archive of the presentation is now available on snort.org

Automated display of Snort IPS events

Features

• Plots Snort IPS events onto Google Earth
• Supports Unified alert files (snort’s recommended output format)
• Auto-update KML file with new events
• Optional auto-refresh Google Earth do display latest attacks
• Highlight latest event on the map
• Represent top locations in the form of a bar (blue = city, green = country)
• Track location statistics along with attacks
• Multi-user capable
• Optional banner for custom branding
• Cool Eye-candy

They say a picture is worth a thousand words, so take a look at the image.

Snoge is now hosted and available on Google Code, head over here to download the latest release.

For help with SnoGE, and if you run into issues please go to http://code.google.com/p/snoge/issues/list

Snoge is a Snort unified reporting tool, it processes your unified files (that’s Snort’s output format), and represents them as place-marks on Google Earth. It can operate in a few modes, Real-time, refresh, and one-time.

Installation

As you may have guessed, SnoGE relies on quite a few external components, to get the system functioning you will need the following

• A Linux system (I’ve used Debian stable while developing, although it should work on other distributions)
• SnortUnified (perl module)
• Geo::IP::PurePerl (perl module)
• NetPacket::Ethernet (perl module)
• The Maxmind geoip database
• A Websever (for the auto update features)

1) Grab and extract the SnoGE tarball

Download here

2) Grab and install build / run requirements

lward@webexprep:~$ mkdir Build
lward@webexprep:~$ cd Build/
lward@webexprep:~/Build$ wget http://snort-unified-perl.googlecode.com/files/SnortUnified_Perl.20070927.tgz
lward@webexprep:~/Build$ tar -zxvf ./SnortUnified_Perl.20070927.tgz
lward@webexprep:~/Build$ cd snort-unified-perl/
lward@webexprep:~/Build/snort-unified-perl$ sudo cp SnortUnified.pm /usr/local/lib/perl/5.10.0
lward@webexprep:~/Build/snort-unified-perl$ cd
lward@webexprep:~$ sudo cpan “NetPacket::Ethernet”
lward@webexprep:~$ sudo cpan “Geo::IP::PurePerl”
lward@webexprep:~$ wget http://geolite.maxmind.com/download/geoip/database/GeoLiteCity.dat.gz
lward@webexprep:~$ gunzip ./GeoLiteCity.dat.gz
lward@webexprep:~$ sudo mkdir /usr/local/share/GeoIP
lward@webexprep:~$ sudo cp GeoLiteCity.dat /usr/local/share/GeoIP/
lward@webexprep:~$ sudo apt-get install apache2

3) Grab your unified Log files

If you have Snort already running on this system, you will likely find them in /var/log/snort/. Showing you how to get Snort working is far beyond the scope of this document.

Configuration

SnoGE’s configuration lives in a single config file, by default it’s called snoge.conf and it should only need some minor tweaks for your environment.

kmlfile=”/var/www/snoge/snoge.kml”

Google Earth reads KML files, therefore this is the output format of SnoGE. Opening a KML file will lead to its contents being plotted on your map. In my example above, I have a directory called “snoge” under /var/www. The user that runs the snoge on my system (lward) has write access to this location.

lward@webexprep:~/snoge$ sudo mkdir /var/www/snoge
lward@webexprep:~/snoge$ sudo chown lward /var/www/snoge/

basefilename=”/var/log/snort/snort.alert”

This base filename for your Unified alert files is set in your snort.conf. I, like most others, use the default snort.alert.

updateurl=”http://192.168.222.133/snoge/snoge.kml”

When run in auto-refresh mode, where can the updates be download from. The IP of my device is 192.168.222.136, and the directory I made earlier was called snoge

Usage

lward@webexprep:~/snoge$ ./snoge

I need a config file. Take a look at usage

* Snort unified -> Google Earth 1.5
leon.ward@sourcefire.com. No warranties are provided or are inferred to the accuracy or reliability of this code.
Use at your own risk.

-c or –config Specify config file
-v or –verbose Enable verbose mode
-o or –onetime One time run with a single unified file.
-r or –refresh Create a “server” KML file for automated updates

For our first try, lets do a simple one-time run through a unified alert file. I have one called /var/log/snort/snort.alert.1240856559

lward@webexprep:~/snoge$ ./snoge -c snoge.conf –onetime /var/log/snort/snort.alert.1240856559
Doing a single run
lward@webexprep:~/snoge$ ls /var/www/snoge/snoge.kml -l
-rw-r–r– 1 lward lward 61685 2009-07-20 09:56 /var/www/snoge/snoge.kml
lward@webexprep:~/snoge$

I now have a KML file to open in Google Earth. Because it’s being written to a location published by Apache, I can access it over the Internet from my OSX laptop. By typing in the URL

SnoGE plotting some events

“http://192.168.222.136/snoge/snoge.kml” into Firefox, Google Earth opens up the KML as expected. A screenshot of mine is on the right there –>.

Because this was a one-time run through, this file will never change. If you like the idea of keeping this file up to date with “current” events, we need to track what events have been plotted and keep looking for more events. Assuming you have configured the basefilename correctly, running snoge without the –onetime flag will keep the file up to date.

Verbose mode will inundate you with information for debugging, but in general snoge is a quiet beast.

lward@webexprep:~/snoge$ ./snoge -c snoge.conf

Every time you RE-OPEN the KML file, it will be up to date. Note that re-open is a key word here, if you want the system to auto-update itself you need to enable refresh mode.

Refresh mode uses a second KML file, and is simple to use. Firstly create your server KML file

lward@webexprep:~/snoge$ ./snoge -r /var/www/snoge/server.kml -c snoge.conf
Creating a server KML to serve event updates
Filename: /var/www/snoge/server.kml
Update interval: 10
ImageURL: http://rm-rf.co.uk/downloads/
Banner: snort-ge-banner.png
lward@webexprep:~/snoge$

Then, run snoge as before

lward@webexprep:~/snoge$ ./snoge -c snoge.conf

Rather than access the snoge.kml file from your google earth client, access the server.kml file instead.