Yes the name is new, and the code is updated.
Mike Guiterman persuaded me to take part in a Snort Users webex “Pimp My Snort”, this gave me a great excuse to update and document my old snort / google earth mash-up. I am now happy to present “SnoGE” (pronounced snoog-ie). An archive of the presentation is now available on snort.org
- Plots Snort IPS events onto Google Earth
- Supports Unified alert files (snort’s recommended output format)
- Auto-update KML file with new events
- Optional auto-refresh Google Earth do display latest attacks
- Highlight latest event on the map
- Represent top locations in the form of a bar (blue = city, green = country)
- Track location statistics along with attacks
- Multi-user capable
- Optional banner for custom branding
- Cool Eye-candy
They say a picture is worth a thousand words, so take a look at the image.
Snoge is now hosted and available on Google Code, head over here to download the latest release.
For help with SnoGE, and if you run into issues please go to http://code.google.com/p/snoge/issues/list
Snoge is a Snort unified reporting tool, it processes your unified files (that’s Snort’s output format), and represents them as place-marks on Google Earth. It can operate in a few modes, Real-time, refresh, and one-time.
As you may have guessed, SnoGE relies on quite a few external components, to get the system functioning you will need the following
- A Linux system (I’ve used Debian stable while developing, although it should work on other distributions)
- SnortUnified (perl module)
- Geo::IP::PurePerl (perl module)
- NetPacket::Ethernet (perl module)
- The Maxmind geoip database
- A Websever (for the auto update features)
1) Grab and extract the SnoGE tarball
2) Grab and install build / run requirements
lward@webexprep:~$ mkdir Build
lward@webexprep:~$ cd Build/
lward@webexprep:~/Build$ wget http://snort-unified-perl.googlecode.com/files/SnortUnified_Perl.20070927.tgz
lward@webexprep:~/Build$ tar -zxvf ./SnortUnified_Perl.20070927.tgz
lward@webexprep:~/Build$ cd snort-unified-perl/
lward@webexprep:~/Build/snort-unified-perl$ sudo cp SnortUnified.pm /usr/local/lib/perl/5.10.0
lward@webexprep:~$ sudo cpan “NetPacket::Ethernet”
lward@webexprep:~$ sudo cpan “Geo::IP::PurePerl”
lward@webexprep:~$ wget http://geolite.maxmind.com/download/geoip/database/GeoLiteCity.dat.gz
lward@webexprep:~$ gunzip ./GeoLiteCity.dat.gz
lward@webexprep:~$ sudo mkdir /usr/local/share/GeoIP
lward@webexprep:~$ sudo cp GeoLiteCity.dat /usr/local/share/GeoIP/
lward@webexprep:~$ sudo apt-get install apache2
3) Grab your unified Log files
If you have Snort already running on this system, you will likely find them in /var/log/snort/. Showing you how to get Snort working is far beyond the scope of this document.
SnoGE’s configuration lives in a single config file, by default it’s called snoge.conf and it should only need some minor tweaks for your environment.
Google Earth reads KML files, therefore this is the output format of SnoGE. Opening a KML file will lead to its contents being plotted on your map. In my example above, I have a directory called “snoge” under /var/www. The user that runs the snoge on my system (lward) has write access to this location.
lward@webexprep:~/snoge$ sudo mkdir /var/www/snoge
lward@webexprep:~/snoge$ sudo chown lward /var/www/snoge/
This base filename for your Unified alert files is set in your snort.conf. I, like most others, use the default snort.alert.
When run in auto-refresh mode, where can the updates be download from. The IP of my device is 192.168.222.136, and the directory I made earlier was called snoge
I need a config file. Take a look at usage
* Snort unified -> Google Earth 1.5
firstname.lastname@example.org. No warranties are provided or are inferred to the accuracy or reliability of this code.
Use at your own risk.
-c or –config Specify config file
-v or –verbose Enable verbose mode
-o or –onetime One time run with a single unified file.
-r or –refresh Create a “server” KML file for automated updates
For our first try, lets do a simple one-time run through a unified alert file. I have one called /var/log/snort/snort.alert.1240856559
lward@webexprep:~/snoge$ ./snoge -c snoge.conf –onetime /var/log/snort/snort.alert.1240856559
Doing a single run
lward@webexprep:~/snoge$ ls /var/www/snoge/snoge.kml -l
-rw-r–r– 1 lward lward 61685 2009-07-20 09:56 /var/www/snoge/snoge.kml
I now have a KML file to open in Google Earth. Because it’s being written to a location published by Apache, I can access it over the Internet from my OSX laptop. By typing in the URL
“http://192.168.222.136/snoge/snoge.kml” into Firefox, Google Earth opens up the KML as expected. A screenshot of mine is on the right there –>.
Because this was a one-time run through, this file will never change. If you like the idea of keeping this file up to date with “current” events, we need to track what events have been plotted and keep looking for more events. Assuming you have configured the basefilename correctly, running snoge without the –onetime flag will keep the file up to date.
Verbose mode will inundate you with information for debugging, but in general snoge is a quiet beast.
lward@webexprep:~/snoge$ ./snoge -c snoge.conf
Every time you RE-OPEN the KML file, it will be up to date. Note that re-open is a key word here, if you want the system to auto-update itself you need to enable refresh mode.
Refresh mode uses a second KML file, and is simple to use. Firstly create your server KML file
lward@webexprep:~/snoge$ ./snoge -r /var/www/snoge/server.kml -c snoge.conf
Creating a server KML to serve event updates
Update interval: 10
Then, run snoge as before
lward@webexprep:~/snoge$ ./snoge -c snoge.conf
Rather than access the snoge.kml file from your google earth client, access the server.kml file instead.