350-201 · Question #86
An engineer wants to review the packet overviews of SNORT alerts. When printing the SNORT alerts, all the packet headers are included, and the file is too large to utilize. Which action is needed to…
The correct answer is D. Modify the output module rule to "output alert_fast: output filename". 2.6.2 alert_fast This will print Snort alerts in a quick one-line format to a specified output file. It is a faster alerting method than full alerts because it doesn't need to print all of the packet headers to the output file and because it logs to only 1 file.
Question
An engineer wants to review the packet overviews of SNORT alerts. When printing the SNORT alerts, all the packet headers are included, and the file is too large to utilize. Which action is needed to correct this problem?
Options
- AModify the alert rule to "output alert_syslog: output log"
- BModify the output module rule to "output alert_quick: output filename"
- CModify the alert rule to "output alert_syslog: output header"
- DModify the output module rule to "output alert_fast: output filename"
How the community answered
(19 responses)- B5% (1)
- D95% (18)
Explanation
2.6.2 alert_fast This will print Snort alerts in a quick one-line format to a specified output file. It is a faster alerting method than full alerts because it doesn't need to print all of the packet headers to the output file and because it logs to only 1 file.
Topics
Community Discussion
No community discussion yet for this question.