[Snort-sigs] Snort as IPS and correlation

lists at ...3397... lists at ...3397...
Fri Apr 10 12:36:06 EDT 2015


On 04/10/2015 11:26 AM, Daniel Lopez wrote:
> Is this possible?

Yes

> How can I do it?

You'll have to develop your own script, I've done this in Perl with hashes.  Hit
me up off-list and I can do some code sharing with you.

> Is there any other way to perform this?

Not that I'm aware of, but I defer to the expertise of the list.

Cheers,
Nathan Fowler




More information about the Snort-sigs mailing list