[Snort-users] Bleeding Edge rules and Barnyard

Bamm Visscher bamm.visscher at ...11827...
Wed Oct 19 08:54:52 EDT 2005

Just merge your sid-msg.maps into one file.  I generally just creat a
sid-msg.map using create-sidmap.pl from oinkmaster.


On 10/19/05, Paul Melson <pmelson at ...11827...> wrote:
> I've just added Barnyard to the mix on one of my sensors, but I'm running
> into a problem.  I would like to continue to run the Bleeding Edge rules on
> this sensor, but it seems as though Barnyard limits me to a single
> sid-msg-map parameter in the config file.  With this set to the standard
> Snort/Sourcefire sid-msg.map file, my Bleeding Edge alerts are showing up as
> "Snort Alert [1:2000328:0]" instead of "BLEEDING-EDGE POLICY Outbound
> Multiple Non-SMTP Server Emails".
> Is there a solution, or is Barnyard still not ready for prime time?
> Thanks,
> PaulM
> -------------------------------------------------------
> This SF.Net email is sponsored by:
> Power Architecture Resource Center: Free content, downloads, discussions,
> and more. http://solutions.newsforge.com/ibmarch.tmpl
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

sguil - The Analyst Console for NSM

More information about the Snort-users mailing list