Syslog on Snort 3 intrusion policy

[raymondluis13]

Hello,

So, in Snort 2 theres an  advanced setting menu and i can enable syslog from there. So in Snort 2, i can only send intrusion event to the SIEM from the intrusion policy.

But, when i try to configure the same thing in snort 3, theres no advanced setting menu, so i cannot set the Intrusion policy to send intrusion events to SIEM.

Is there a way to configure this on the Snort 3? if not, then is there a way to only send intrusion events to the SIEM?

Thank you

[Harinadababu Ruthala]

Please check the logging tab on the AC policy.  Syslog for IPS events should be there.