Created
December 2, 2024 13:13
-
-
Save jstrosch/0001299e348d18fbff51bfa3837125b0 to your computer and use it in GitHub Desktop.
suri-pcap.bat
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| set log="C:\Users\TheCyberYeti\AppData\Local\Temp\suri" | |
| @echo OFF | |
| echo y | del "%log%\*" | |
| @echo ON | |
| suricata -k none -r %1 --runmode=autofp -l "%log%" -s "C:\Program Files\Suricata\custom.rules" | |
| @echo OFF | |
| grep "event_type\":\"alert" "%log%\eve.json" | jq "\"\(.alert.signature) (SID \(.alert.signature_id)): \(.alert.category) from \(.src_ip):\(.src_port) - \(.dest_ip):\(.dest_port)\"" |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment