[Snort-users] Classifications

Kenneth G. Arnold bkarnold at ...8060...
Wed Jan 22 11:15:03 EST 2003


The classification is stored in the database so you could use sql to change 
or set the classification of a preprocessor for ACID.  Snortsnarf is 
another matter since it uses the alerts file directly.
Ken

At 07:05 AM 1/22/03 +0100, Peter VE wrote:
>Hi all,
>
>
>Is it possibe to assign a classification to a preprocessor ? (e.g. to the
>portscan preprocessors;
>all of the log entries do not carry a classification, and it would be easier
>to maintain with ACID or another frontend
>if the preprocessor has a classification...
>
>Does anyone know how to assign classtypes to a preprocessor ?
>Or is this a matter of re-programming the preprocessor so it would support a
>classtype
>
>thanks
>
>P
>
>
>
>-------------------------------------------------------
>This SF.net email is sponsored by: Scholarships for Techies!
>Can't afford IT training? All 2003 ictp students receive scholarships.
>Get hands-on training in Microsoft, Cisco, Sun, Linux/UNIX, and more.
>www.ictp.com/training/sourceforge.asp
>_______________________________________________
>Snort-users mailing list
>Snort-users at lists.sourceforge.net
>Go to this URL to change user options or unsubscribe:
>https://lists.sourceforge.net/lists/listinfo/snort-users
>Snort-users list archive:
>http://www.geocrawler.com/redir-sf.php3?list=snort-users





More information about the Snort-users mailing list