[Snort-users] New rule SID question ...
JHicks at ...5857...
Fri Jul 12 11:42:18 EDT 2002
my bad ... but thanks for the help ;)
From: Erek Adams [mailto:erek at ...577...]
Sent: Friday, July 12, 2002 2:33 PM
To: Hicks, John
Cc: Snort Users (E-mail)
Subject: Re: [Snort-users] New rule SID question ...
On Fri, 12 Jul 2002, Hicks, John wrote:
> I just got an email anouncing a new M$ Encapsulated SMTP Address
> Vulnerability (attached for reference) and I'm trying to write a new rule
> for this, but have 1 question. What do I assign as a SID??? Do I have to
> look for an unused one from some master list???
You might also want to send over your rules and info on the vuln to
since that's where all the signature mongers hide. :)
Oh, and take one penalty drink. ;-)
More information about the Snort-users