Introduction

Regulatory and compliance-style reporting has created a micro-industry in the technology world for companies that can collect, analyze, correlate, and then report on an organization's data. Although this motivation and requirement is not entirely new and we have seen it multiple times in the past, it remains a business driver. Snort's underlying packet-sniffing platform is ideal for gathering all types of network and infrastructure information in real time. However, with the original release of Snort, it was very difficult to grab particular types of information from the underlying Snort application. Output options had to be compiled directly into the source, which made it a complex endeavor to create different types of information views.

The Snort development team acknowledged this challenge and answered it by creating an open output plug-in API. Snort output plug-ins, also referred to as Snort output modules, were introduced in version 1.6. The introduction of output plug-ins officially completed Snort's inauguration into the elite group of enterprise-class intrusion detection systems (IDSes). Output plug-ins provide administrators the ability to configure logs and alerts in a manner that is flexible, as well as easy to understand, read, and use in their organization's environment. For example, if Acme Widgets uses MySQL databases to store all corporate and client information, we can assume that Acme Widgets has a good amount of in-house knowledge of MySQL. Therefore, it makes sense that Acme would also want its network IDS (NIDS) logs and alerts to be stored in a MySQL database, or...