SELKS/Suricata output to another probe or SOC

[michal25]

trafficstars

Is there an existing feature request that has already been created?

• [X] I have searched the exiting features requests

Is your feature request related to a problem? Please describe.

My question is. Is it possible to forward SELKS/Suricata output to another probe or SOC?

Destination probe will mark the data as Probe1, Probe2 etc.

Searching machines will find issues with answer yes, but no text about HOW. For example snort / barnyard had this possibility and it was very useful.

Describe the solution you would like?

URL to manual how to use the options in the suricata.yaml configuration file.

Alternative Solutions

No response

Additional Context

No response

[pevma]

Yes, you can do that on any suricata install - just use filebeat for example to forward the logs.