[Snort-users] Signature Message, PP, and sid-msg.map

Y M snort at ...15979...
Sun Dec 2 07:17:21 EST 2012


This may have been discussed before but I did not find a definitive answer or an optimal solution. I use PulledPork to generate VRT rules (snort.rules) and the sid-msg.map, etc. The process completes successfully. I run Snort and alerts start showing up, however, I do not get signature messages (sig_name in the DB table) for some rules in there. I only get something like, for examples: "Snort Alert [1:255:19]". This happens to a considerable amount of rules. Since the rules are firing and they exist in the snort.rules file, this means that they have been processed by PulledPork, however, they do not have respective entries in the sid-msg.map file. I updated those manually, both in the database and the sid-msg.map file and now are showing up fine. As snort continues to run, I get new alerts with no signature message and do the updates again and so on. My question(s) is, does PulledPork generate the sid-msg.map file dynamically once it is run? If so, why some rules do not get mapped into the file? I have read in a group discussion (can't remember where!) that this is related to the reorganization of the rules and should go away once everything stabilizes, please correct if I am wrong. This can take an effort to get rules updated to show up properly every time the rules are updated and PulledPork is run.  Any help would be appreciated. Thanks in advance.YM  		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20121202/0e0623d4/attachment.html>


More information about the Snort-users mailing list