[Snort-users] Classifications

Peter VE peter.ve at ...1187...
Wed Jan 22 12:54:08 EST 2003


interesting idea... I'll try that

thanks a lot !!!

P

----- Original Message -----
From: "Kenneth G. Arnold" <bkarnold at ...8060...>
To: <snort-users at lists.sourceforge.net>
Sent: Wednesday, January 22, 2003 8:14 PM
Subject: Re: [Snort-users] Classifications


> The classification is stored in the database so you could use sql to
change
> or set the classification of a preprocessor for ACID.  Snortsnarf is
> another matter since it uses the alerts file directly.
> Ken
>
> At 07:05 AM 1/22/03 +0100, Peter VE wrote:
> >Hi all,
> >
> >
> >Is it possibe to assign a classification to a preprocessor ? (e.g. to the
> >portscan preprocessors;
> >all of the log entries do not carry a classification, and it would be
easier
> >to maintain with ACID or another frontend
> >if the preprocessor has a classification...
> >
> >Does anyone know how to assign classtypes to a preprocessor ?
> >Or is this a matter of re-programming the preprocessor so it would
support a
> >classtype
> >
> >thanks
> >
> >P
> >
> >
> >
> >-------------------------------------------------------
> >This SF.net email is sponsored by: Scholarships for Techies!
> >Can't afford IT training? All 2003 ictp students receive scholarships.
> >Get hands-on training in Microsoft, Cisco, Sun, Linux/UNIX, and more.
> >www.ictp.com/training/sourceforge.asp
> >_______________________________________________
> >Snort-users mailing list
> >Snort-users at lists.sourceforge.net
> >Go to this URL to change user options or unsubscribe:
> >https://lists.sourceforge.net/lists/listinfo/snort-users
> >Snort-users list archive:
> >http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: Scholarships for Techies!
> Can't afford IT training? All 2003 ictp students receive scholarships.
> Get hands-on training in Microsoft, Cisco, Sun, Linux/UNIX, and more.
> www.ictp.com/training/sourceforge.asp
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>





More information about the Snort-users mailing list