Thanks to Jason for his help, in the end the gshield config was almost exactly what we needed.

[code]
#!/usr/bin/perl -w

# Feb 25 13:40:30 bashful kernel: firewall: IN=eth0 OUT= MAC=00:0e:b6:69:a8:c7:12:54:4f:dc:b4:1c:08:00
SRC=64.124.2.53 DST=61.1.1.1 LEN=48 TOS=0×00 PREC=0×00 TTL=115 ID=11556 DF PROTO=TCP SPT=2213 DPT=135
WINDOW=8760 RES=0×00 SYN URGP=0

$event{’kernel’}{’iptables’} =
sub {
if ($text =~ m/^firewall: .* SRC=(\S+) DST=(\S+) .* DPT=(\d+)/) {
if ($unixtime > $MaxDBUnixTime) {
my $src = $1;
my $dst = $2;
my $dpt = $3;

$event = ‘iptables’;
$sender = $src;
$recipient = $dst;
$value1 = $dpt;

$FoundNewRow = 1;
}
}
};
[/code]
And an example: