[Snort-users] New snort rule lookup

Frank Knobbe frank at ...9761...
Mon Mar 28 13:45:05 EST 2005


On Mon, 2005-03-28 at 16:06 -0500, John Hally wrote:
> I noticed that the new rule lookup doesn't have the actual rule syntax
> included as it did before.  Was this planned?  I found that helped a
> LOT when trying to determine if the alert was malicious or not.

Heya John!

My guess would be that the web site is not able to distinguish between
the GPL rules and the VRT rules. Thus the web site does not display the
actual rules anymore. As you recall, you have to sign up for the VRT
rules.

That said, "grep 'sid:1234567' *.rules" works just as well. Just take a
look at the Snort rule themselves.

Cheers,
Frank

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 187 bytes
Desc: This is a digitally signed message part
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20050328/09f8b42c/attachment.sig>


More information about the Snort-users mailing list