[Snort-users] ACID Sensor query

roman at ...438... roman at ...438...
Mon Nov 19 11:07:04 EST 2001


There is currently no way to "fix" the sensor ID.  ACID provides no
support for restricting what data can be viewed in the database.    
  
Of course this doesn't mean the code could not be hacked up to provide this
functionality.  The quick way to do this would probably involve replacing
all 'acid_event.sid = <some table>.sid' with 'acid_event.sid = 1'.
Likewise, all SQL which does not impose criteria on the SID, would also
required an explicit 'sid = 1' in the WHERE clause.

Roman

On Mon, 19 Nov 2001 Gmlabs at ...661... wrote:

> Does anyone know whare I can set the variable to make the sensor id fixed ?
> 
> I'm creating a site to display only the info for 1 sensor, but since i'm not the
programmer I can't follow the cod that well. I saw the $sensor variable points to the
sensor id , but can I fix that value at the initial main query ?
> 
> Thank you
> Gerhard
> 
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
> 
> 



---------------------------------------------
This message was sent using Voicenet WebMail.
      http://www.voicenet.com/webmail/






More information about the Snort-users mailing list