[Snort-users] Is there any way to add the rule action in the alert?

waldo kitty wkitty42 at ...14940...
Mon Jul 15 16:20:51 EDT 2013


On 7/15/2013 15:56, Avery Rozar wrote:
> I would like to have the term "drop" or "dropped" in the Alert, is this possible?

in the alert message text? yes, it is possible but you have to edit all enabled 
rules to put it in the msg:"message text here"; field in the rules...

-- 
NOTE: No off-list assistance is given without prior approval.
       Please keep mailing list traffic on the list unless
       private contact is specifically requested and granted.




More information about the Snort-users mailing list