Depreciation of Unified2 support in Sagan.

10 views

Skip to first unread message

Da Beave

unread,

Apr 10, 2019, 10:28:53 PM4/10/19

to sagan-users

Hello,

We are looking to remove support for Unified2 at or after October 1st, 2019.

If you are using Sagan with Unified2, we advise you to move to the "EVE" output format and use "Meer" (https://quadrantsec.com/meer/) or some other database back end (Elasticsearch, etc). Meer works similar to "Barnyard2", but rather than reading Unified2 spools, it reads the more flexible "eve" files. Meer writes to a database very similar to Barnyard2 and support MariaDB, MySQL and PostgreSQL.