[Snort-users] SQL login attempts

Don Don at ...5881...
Fri Jun 7 00:03:02 EDT 2002

the alerting for SQL login attempts, shouldn't that alert be reversed, such
as alert on the attempted login, instead of alerting for the reply of sa
login failed. currently, i am getting the alerts for the response from my
sql that the login failed, so MY system shows up in the reporting, instead
of the offending system. anyone have a rule set that alerts on the attempt
instead of the response to the attempt?
thanks in advance


More information about the Snort-users mailing list