[Snort-users] Rules question. Or clause with content keyword in rule.

Andrei_1980 andrei_1980 at ...1975...
Sun Feb 1 05:32:15 EST 2015


Hello! I want create rule, that will fire if uri not contain some 
substrings.  For example, my site has two pages: main.htm and test.html, 
and I want write  rule like:
content: ! “main.html” *or* !“test.html”; http_uri;

Is any way to do this in Snort?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20150201/6e7e1b93/attachment.html>


More information about the Snort-users mailing list