[Snort-users] snort rules/signatures
Humes, David G.
David.Humes at ...383...
Thu May 25 08:50:03 EDT 2006
SGUIL incorporates a feature to show the rules that trigger the alerts.
SGUIL can be found at http://sguil.sourceforge.net. Take a look at the
screen shots or the Flash demo.
From: snort-users-admin at lists.sourceforge.net
[mailto:snort-users-admin at lists.sourceforge.net] On Behalf Of John Hally
Sent: Thursday, May 25, 2006 10:17 AM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] snort rules/signatures
Way back when the original snort.org site used to include the
actual signature of the rule whenever you looked up an SID or clicked on
one from an alert in acid/base. I found this EXTREMELY useful when
checking the validity of an alert to see if it was simply a pattern
match or something else triggering the alert and react accordingly. My
question is, has anyone found a way to tie the signatures to alerts by
hacking up Base or some other console? It would be very cool if
snort.org could add the signature back to the description, but if
there's another way to do it without me having to keep IDS Policy
Manager open and refer back to it, that would be outstanding.
I'm thinking of possibly importing the ruleset(s) into mysql (a
la snortcenter/snortcenter2) and then try to figure out a way to add a
link to them from any of the consoles out there in use. I'm currently
using Aanval and have asked for this as an enhancement, but not sure how
long that will take, if ever. Just looking to see if anyone else is
doing something similar.
Thanks in advance!
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Snort-users