Snort mailing list archives
Pulledpork and sid-msg.map
From: Avery Rozar <Avery.Rozar () i-techsupport com>
Date: Wed, 26 Mar 2014 15:05:41 +0000
Is it safe to assume when using pulledpork the msg field in the snort.rules gets pulled into the sid-msg.map for barnyard2 to write into the alert? If so, where in the pulledpork.pl script should I add a shell script to add drop into the msg field. I can run this [sed -i '/^drop/s/(msg:"/(msg:"drop - /‘ /etc/snort/rules/snort.rules] in a shell script and adds the drop into the msg field, but I need to do this before the sid-msg.map is generated for this to work. I’ve added the following command in two places with no luck. system ("sh /opt/scripts/./add_drop_msg.sh”); At the end of [sub rule_write] If I put it here it will write drop in the msg on the snort.rules, but not sid-msg.map. At the beginning of [sub sid_write] If I put it here it will write drop in the msg on the snort.rules, but not sid-msg.map. ------------------------------------------------------------------------------ Learn Graph Databases - Download FREE O'Reilly Book "Graph Databases" is the definitive new guide to graph databases and their applications. Written by three acclaimed leaders in the field, this first edition is now available. Download your free book today! http://p.sf.net/sfu/13534_NeoTech _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Pulledpork and sid-msg.map Avery Rozar (Mar 26)
- Re: Pulledpork and sid-msg.map Jeremy Hoel (Mar 26)
- Re: Pulledpork and sid-msg.map Avery Rozar (Mar 26)
- Re: Pulledpork and sid-msg.map Jeremy Hoel (Mar 26)
- Re: Pulledpork and sid-msg.map Avery Rozar (Mar 26)
- Re: Pulledpork and sid-msg.map Avery Rozar (Mar 26)
- Re: Pulledpork and sid-msg.map Jeremy Hoel (Mar 26)