[Snort-users] Classifications

Chris Green cmg at ...1935...
Wed Jan 22 10:52:02 EST 2003


"Peter VE" <peter.ve at ...1187...> writes:

> Hi all,
>
>
> Is it possibe to assign a classification to a preprocessor ? (e.g. to the
> portscan preprocessors;
> all of the log entries do not carry a classification, and it would be easier
> to maintain with ACID or another frontend
> if the preprocessor has a classification...
>
> Does anyone know how to assign classtypes to a preprocessor ?
> Or is this a matter of re-programming the preprocessor so it would support a
> classtype

They are hardcoded in the preprocessors currently. It'd be nice to
have that configurable but it's not happening in the immediate future.
-- 
Chris Green <cmg at ...1935...>
This is my signature. There are many like it but this one is mine.




More information about the Snort-users mailing list