[Snort-users] New Rules Heads Up

Gregory Zill gregory at ...14510...
Fri Nov 4 16:10:18 EDT 2011

Sourcefire support sends out an SEU notice via e-mail. I pull/apply
new the SEU automatically once per week to allow review. Also,
Sourcefire enables variables automatically within the SEU application.

However, I am not finding the ID 20456 searching through Snort,
Emerging or Sourcefire rule bases.

On Fri, Nov 4, 2011 at 2:39 PM,
<snort-users-request at lists.sourceforge.net> wrote:
> ------------------------------
> Message: 6
> Date: Fri, 4 Nov 2011 14:39:01 -0500
> From: "Gibson, Nathan J. (HSC)" <Nathan-Gibson at ...15095...>
> Subject: [Snort-users] New Rules Heads Up
> To: "snort-users at lists.sourceforge.net"
>        <snort-users at lists.sourceforge.net>
> Message-ID:
>        <B30DD99805FB504981E5411867CF4B9C27A97670FF at ...15096...>
> Content-Type: text/plain; charset="us-ascii"
> Hey all,
> How does one go about staying informed about new Source Fire rules that add additional variables BEFORE they are added to the rule set.
> For example it seems a variable "$FILE_DATA_PORTS" was introduced last night that bombed out my snort. Just wondering if there is a way I can get proactive on this. And turn them off in pulled pork BEFORE it kills my IDS in the middle of the night.
> alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-IDENTIFY Real Media file magic detection"; flow:to_client,established; file_data; content:".RMF"; within:4; fast_pattern; flowbits:set,http.realplayer,fileidentify; flowbits:noalert; classtype:misc-activity; sid:20456; rev:2;)

Gregory W Zill

More information about the Snort-users mailing list