[Snort-users] Aurora Exploit Attempt Alert One Hour Delay

Kevin Ross kevross33 at ...14012...
Thu Jan 23 14:43:24 EST 2014


How are you logging this? It is likely either timezone stuff on local
system, in barnyard or if using something like Snorby the correct timezone
not being set such as GMT. So while the alert is generated the time is
appearing as 1 hour later.


On 23 January 2014 16:28, LaTonya Hall <lhall at ...16550...> wrote:

> There is about a one hour delay from exploit attempt to snort alert…any
> ideas?
>
> *-LaTonya*
>
>
>
>
>
> ------------------------------------------------------------------------------
> CenturyLink Cloud: The Leader in Enterprise Cloud Services.
> Learn Why More Businesses Are Choosing CenturyLink Cloud For
> Critical Workloads, Development Environments & Everything In Between.
> Get a Quote or Start a Free Trial Today.
>
> http://pubads.g.doubleclick.net/gampad/clk?id=119420431&iu=/4140/ostg.clktrk
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest
> Snort news!
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20140123/8068865a/attachment.html>


More information about the Snort-users mailing list