[Snort-users] Relation between events and rules set.
jjaime at ...2272...
Thu Apr 24 12:28:08 EDT 2003
Im sorry, english is not my language and is difficult to me explain
You have differents set of rules :
web-cgi.rules, web-coldfusion.rules, web-frontpage.rules,
web-iis.rules, web-misc.rules, x11.rules... etc.
The events trigger specific rules ( rules on these set of rules ).
Ex : WEB-IIS cmd.exe access ---> on web-iis.rules
The only reference to the set of rules on snort alert is the msg
header, and is not reliable. ( ex. on web-misc.rules you have msg with
WEB-MISC and WEB-PHP... )
If we can to know the set of rules that trigger the events, we can
use it to calculate the event severity.
"WEB-IIS cmd.exe access" alert is not dangerous on Apache Web
It's ok ?
Thanks a lot.
De: John Sage [mailto:jsage at ...2022...]
Enviado el: Miércoles, 23 de Abril de 2003 10:10 p.m.
Para: Julio Jaime
CC: 'snort-users at lists.sourceforge.net'
Asunto: Re: [Snort-users] Relation between events and rules set.
Let's do a little trimming:
On or about Wed, Apr 23, 2003 at 04:47:30PM -0300, Julio Jaime posited:
> Hi all,
> We are working on threath management system using snort +
> logsnorter + syslog servers, but the core is snort.
> I need know , how find the relation between the event and the
> set of rules that trigger it event.
Is the question "which specific rule was triggered by a specific
event" ie: alert?
grep 'insert_phrase_from_alert' *
[**] [1:0:0] TCP inbound to 80 http [**]
04/21/03-18:07:00.234228 184.108.40.206:1894 -> 220.127.116.11:80
TCP TTL:120 TOS:0x0 ID:14681 IpLen:20 DgmLen:48 DF
******S* Seq: 0xDEEB0032 Ack: 0x0 Win: 0x2238 TcpLen: 28
TCP Options (4) => MSS: 1460 NOP NOP SackOK
[toot at ...8592... /storage/snort]$ grep 'inbound to 80' *
tcp191-local.rules:alert tcp $EXTERNAL_NET any -> $HOME_NET 80
(msg:"TCP inbound to 80 http";)
"You are in a twisty maze of weblogs, all alike."
PGP key: http://www.finchhaven.com/pages/gpg_pubkey.html
Fingerprint: C493 9F26 05A9 6497 9800 4EF6 5FC8 F23D 35A4 F705
More information about the Snort-users