Snort mailing list archives
Re: Alert classification and priority
From: Gary_Portnoy () itginc com
Date: Thu, 3 Jun 2004 08:15:53 -0400
priority: <value>; You can add it to each rule to set the priority. If no priority is set (as with nearly all default rules) the priority is taken via the classtype key which relates to the classification.config file.
I was looking for something more in the way of threshold.conf where I could change the priorities without changing the rule files, so that upgrading to new rules doesn't reset them back to default priority values. The way I see it, the rule files should not be changed, any local customizations should be done via instance-specific files, like snort.conf, threshold.conf, local.rules, etc.
Even barnyard does not check for a changed priority of a rule and will still use the old prioity.
As far as I understand, unified plugin just writes out the event with all the relevant info and barnyard looks at classification.config and determines the priority. So one way to achieve what I am trying to do with barnyard (i am focusing on it because that's what I am using) would be to create a different classification type with a different priority and then use that classification type in my rules. Barnyard then should (should being the keyword, i haven't tried this) log the correct classtype/priority to the database. But again, this requires me to change the rules files. What I want is a priority.config file where I can override the default priority by saying something along the lines of: gen_id 1, sig_id 555, priority 3 I guess I can add this to the wish list. :) -g- ------------------------------------------- Gary Portnoy Information Security Analyst ITG, Inc. Dirk Geschke <Dirk_Geschke () genua de> 06/03/2004 03:20 AM To: Gary_Portnoy () itginc com cc: snort-users () lists sourceforge net, Dirk_Geschke () genua de Subject: Re: [Snort-users] Alert classification and priority Hi Gary,
Is there any way to de-couple alert classification from priority on a rule-by-rule basis in a local type file?
yes of course: snort/docs/snort_manual.pdf, chapter 2.4.6 Priority priority: <value>; You can add it to each rule to set the priority. If no priority is set (as with nearly all default rules) the priority is taken via the classtype key which relates to the classification.config file. But be aware, if you use the database output plugin then the it may still show the old priority since this value is not checked. Of course, you can use FLoP (http://www.geschke-online.de/FLoP) with the DBTrust option enabled. This will take care of the changed priority. (Even barnyard does not check for a changed priority of a rule and will still use the old prioity.) BTW: With FLoP-1.2.3 there is a perl script called rules.pl which will insert all signatures with references to the database. This script is also able to add signatures with a range of priorities set. (I think it is not uncommon to have different priorities for the same rule depending on the place where snort sniffs.) Best regards Dirk -+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- This message is for the named person's use only. This communication is for informational purposes only and has been obtained from sources believed to be reliable, but it is not necessarily complete and its accuracy cannot be guaranteed. It is not intended as an offer or solicitation for the purchase or sale of any financial instrument or as an official confirmation of any transaction. Moreover, this material should not be construed to contain any recommendation regarding, or opinion concerning, any security. It may contain confidential, proprietary or legally privileged information. No confidentiality or privilege is waived or lost by any mistransmission. If you receive this message in error, please immediately delete it and all copies of it from your system, destroy any hard copies of it and notify the sender. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient. Any views expressed in this message are those of the individual sender, except where the message states otherwise and the sender is authorized to state them to be the views of any such entity. ITG Inc. reserves the right to monitor and archive all electronic communications through its network. ITG Inc. Member NASD, SIPC -+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- ------------------------------------------------------- This SF.Net email is sponsored by the new InstallShield X.
From Windows to Linux, servers to mobile, InstallShield X is the one
installation-authoring solution that does it all. Learn more and evaluate today! http://www.installshield.com/Dev2Dev/0504 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Alert classification and priority Gary_Portnoy (Jun 02)
- Re: Alert classification and priority Dirk Geschke (Jun 03)
- <Possible follow-ups>
- Re: Alert classification and priority Gary_Portnoy (Jun 03)
- Re: Alert classification and priority Dirk Geschke (Jun 03)
- Re: Alert classification and priority SN ORT (Jun 03)