[Snort-users] Reference:url not working

Alex Butcher, ISC/ISYS Alex.Butcher at ...11254...
Wed Sep 22 00:50:07 EDT 2004

--On 21 September 2004 08:05 -0700 SN ORT <snort_on_acid at ...131...> wrote:

> This is a bit of a pain, but the reference:url line in
> any signature is not working so that it pops up a ling
> in the ACID alert view. I see the "url" word, but it's
> not hyper-linked so that I can click and read about
> the particular alert and it's origins.
> Just a simple:
> "reference:url,securityresponse.symantec.com/avcenter/venc/data/w32.atak@
> mm.html;"
> in a rule should produce a:
> "url[snort]"BLEEDING-EDGE VIRUS Possible Atak.mm Worm
> Outbound"
> in ACID, with the "url" portion of that hyperlinked to
> the alert information.
> Suggestions?

Check that you have:

        "url" => array("http://")

included in the $external_sig_link array defined in acid_conf.php.

> Cheese!
> Marc

Best Regards,
Alex Butcher: Security & Integrity, Personal Computer Systems Group
Information Systems and Computing             GPG Key ID: F9B27DC9
GPG Fingerprint: D62A DD83 A0B8 D174 49C4 2849 832D 6C72 F9B2 7DC9

More information about the Snort-users mailing list