[Snort-users] Excluding $HOME_NET -> $HOME_NET Alerts
michael.boman at ...4162...
Mon May 20 17:49:02 EDT 2002
-----BEGIN PGP SIGNED MESSAGE-----
On Tuesday 21 May 2002 00:21, Ed Kasky wrote:
> The only problem with this is that it changes the "Signature" description
> of each Alert to "(External) Incoming
> Can it be done without the msg description so that it leaves Snort's
But of course. The 'msg:"some message here";' keyword has nothing to do with
how the signature rule work, so you can change it to what-ever you want.
Security Architect, SecureCiRT (A SBU of Z-Vance Pte Ltd)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org
-----END PGP SIGNATURE-----
More information about the Snort-users