Re: gen-msg file

[Joel Esler <jesler () sourcefire com>]

You need to use the create sig-msg.map script that comes with oinkmaster. 

--
Sent from my iPad

On Jul 26, 2010, at 2:42 AM, ll <ibeginhere () gmail com> wrote:

> yes, I read that from the user  manual .I wrote a rule like that 
> "gid:200;sid:1000001;rev:1;classtype:web-application-attack;)" 
> and I modified the gen-msg.map file 
> # Format: generatorid || alertid || MSG
> 200 || 1 || test 
> and the sid-msg.map file
> 1000001 || browse directory || url,doc.emergingthreats.net/bin/view/Main/TorRules
> but, the signature indicate in the BASE like that 
> Snort Alert [200:1000001:0]
>
> I want to some message can indicate in the BASE,but not just the number .
>
> 于 2010-7-23 19:55, Joel Esler 写道:
> > Generatorid is the number of the individual generator (preprocessor, rule), alert id is the number of the individual 
> > alert, within that generator.
> >
> > The MSG describes the first two.
> >
> > J
> >
> > On Jul 23, 2010, at 6:02 AM, ll wrote:
> >
> >   
> > > hi,all
> > > in the file gen-msg.map
> > > # Format: generatorid || alertid || MSG
> > >
> > > what is that alertid means ? there are not mentioned in the users manual ?
> > >     
> >
> >
> >   

------------------------------------------------------------------------------
The Palm PDK Hot Apps Program offers developers who use the
Plug-In Development Kit to bring their C/C++ apps to Palm for a share 
of $1 Million in cash or HP Products. Visit us here for more details:
http://ad.doubleclick.net/clk;226879339;13503038;l?
http://clk.atdmt.com/CRS/go/247765532/direct/01/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users