Re: preprocessor sensitive_data (snort 2.8.6.0)

[Joel Esler <jesler () sourcefire com>]

Take a look at the sensitive-data.rules as well as the README for the sensitive data preprocessor to see how you can 
write your own rules, etc, to detect what you'd like.

The rules are great examples, you can build from there.


On Jun 3, 2010, at 6:06 PM, Lawrence R. Hughes, Sr. wrote:

> Hi,
>  
> When we enable the "preprocessor sensitive_data", we are getting alerts for everyday cookies.
> Is there a way to tighten this up or disable the cookies from being detected?

--
Joel Esler
302-223-5974
Jabber: jesler () sourcefire com

------------------------------------------------------------------------------
ThinkGeek and WIRED's GeekDad team up for the Ultimate 
GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the 
lucky parental unit.  See the prize list and enter to win: 
http://p.sf.net/sfu/thinkgeek-promo

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users