Snort mailing list archives
Re: metadata questions
From: "Morris, Shane (US SSA)" <shane.morris () baesystems com>
Date: Fri, 31 May 2013 00:34:32 +0000
I have SF 5.x and OpenSrc Snort so that's good to know about OS Snort; I thought it was the same requirement in the newest version of Snort. Example: content: "hello"; metadata: service http; If we want this to fire in both http and non http streams (non-defined protocol), how do we do this? -Shane From: Joel Esler [mailto:jesler () sourcefire com] Sent: Thursday, May 30, 2013 2:52 PM To: Morris, Shane (US SSA) Cc: snort-users () lists sourceforge net Subject: Re: [Snort-users] metadata questions On May 30, 2013, at 2:32 PM, "Morris, Shane (US SSA)" <shane.morris () baesystems com<mailto:shane.morris () baesystems com>> wrote: 1. According to the snort manual the metadata key values are engine, soid and service but Ive seen rules written with other options like "metadata: author snortguru". Is there a list of available keys or are all keys other than engine, soid and service treated as comments. It's a free flowing text field. The only field that Open Source Snort uses is "service", and only if you have Adaptive profiling turned on with a host attribute table. 2. If I am writing a rule that I want to fire on HTTP and non-HTTP traffic how could I do this since you have to use metadata and specify a service in the newest version of Snort? Can you give me an example? (you only have to specify a service in the >=5.x Sourcefire product, this does not effect Open Source Snort) -- Joel Esler Senior Research Engineer, VRT OpenSource Community Manager Sourcefire
------------------------------------------------------------------------------ Get 100% visibility into Java/.NET code with AppDynamics Lite It's a free troubleshooting tool designed for production Get down to code-level detail for bottlenecks, with <2% overhead. Download for free and get started troubleshooting in minutes. http://p.sf.net/sfu/appdyn_d2d_ap2
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- metadata questions Morris, Shane (US SSA) (May 30)
- <Possible follow-ups>
- Re: metadata questions Joel Esler (May 30)
- Re: metadata questions Morris, Shane (US SSA) (May 30)
- Re: metadata questions Joel Esler (May 31)
- Re: metadata questions Morris, Shane (US SSA) (May 31)
- Re: metadata questions Joel Esler (May 31)