[Snort-users] Fwd: tuning sigs priority with modifysid
bmc at ...950...
Tue Oct 31 05:44:44 EST 2006
On Mon, Oct 30, 2006 at 12:48:04PM -0500, martin wrote:
> It occured to me that "classtype:" would override any local priority setting.
> Does that mean the only way around that is to do modifysid on
> classtype and remove it or change the classtype? Any pros/cons?
Priority is supposed to overwrite classtype.
At least, when I added priority to snort such a long time ago, that
was it did. classtype sets the default priority, but rules can
explicit priority via the priority keyword.
More information about the Snort-users