[Snort-users] Bleeding Edge rules and Barnyard
pmelson at ...11827...
Wed Oct 19 08:12:30 EDT 2005
I've just added Barnyard to the mix on one of my sensors, but I'm running
into a problem. I would like to continue to run the Bleeding Edge rules on
this sensor, but it seems as though Barnyard limits me to a single
sid-msg-map parameter in the config file. With this set to the standard
Snort/Sourcefire sid-msg.map file, my Bleeding Edge alerts are showing up as
"Snort Alert [1:2000328:0]" instead of "BLEEDING-EDGE POLICY Outbound
Multiple Non-SMTP Server Emails".
Is there a solution, or is Barnyard still not ready for prime time?
More information about the Snort-users