[Snort-users] Real Time Alert and Variables

Y M snort at ...15979...
Fri Jan 25 12:00:40 EST 2013

You can also use custom action types. You define them in snort.conf file, and use the new custom action type with your rules. Sorry can't provide resources at the moment, but it should be in the manual.

From: Nicholas Horton<mailto:fivetenets at ...14399...>
Sent: ‎1/‎25/‎2013 7:26 PM
To: Snort Users<mailto:snort-users at lists.sourceforge.net>
Subject: [Snort-users] Real Time Alert and Variables

Is swatch still the best, only, current solution to kick off a script with variables such as source ip based on a specific snort alert?


Master Visual Studio, SharePoint, SQL, ASP.NET, C# 2012, HTML5, CSS,
MVC, Windows 8 Apps, JavaScript and much more. Keep your skills current
with LearnDevNow - 3,200 step-by-step video tutorials by Microsoft
MVPs and experts. ON SALE this month only -- learn more at:
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

Please visit http://blog.snort.org to stay current on all the latest Snort news!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20130125/551229c5/attachment.html>

More information about the Snort-users mailing list