[Snort-users] Dectecting Social Security Numbers?

Lyons, Jon Jon_Lyons at ...11066...
Fri Sep 10 11:05:20 EDT 2004


 
I'm trying to get snort to generate an alert for SS#'s, I've tried the
rule below but no alerts are generated. I tested this with pcretest and
it works...am I missing something?
alert tcp any any -> any any (msg:"Socail Security Number Clear Text";
pcre:"m!(\d\d\d[-/]\d\d[-/]\d\d\d\d)\Z!";)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20040910/41265f4c/attachment.html>


More information about the Snort-users mailing list