[Snort-users] SQL login attempts

Don Don at ...5881...
Fri Jun 7 00:03:02 EDT 2002


the alerting for SQL login attempts, shouldn't that alert be reversed, such
as alert on the attempted login, instead of alerting for the reply of sa
login failed. currently, i am getting the alerts for the response from my
sql that the login failed, so MY system shows up in the reporting, instead
of the offending system. anyone have a rule set that alerts on the attempt
instead of the response to the attempt?
thanks in advance

Don





More information about the Snort-users mailing list