Snort mailing list archives
Re: Snort Drop Rules Logging
From: PS <packetstack () gmail com>
Date: Wed, 30 Jul 2014 11:14:48 -0400
Thanks Joel! On Jul 30, 2014, at 11:07 AM, Joel Esler (jesler) <jesler () cisco com> wrote:
The results you are looking for are in the unified2 output log. -- Joel Esler Open Source Manager Threat Intelligence Team Lead Vulnerability Research TeamOn Jul 30, 2014, at 9:46 AM, PS <packetstack () gmail com> wrote: Hello, I did some searching online to see if I could fine the answer to my question, but I was not able to find it. I want to know if there is a way to determine the action of a signature match. I don’t see in the “alert_full” anywhere where it would indicate a Drop vs Alert. Not sure if it is any different for unified logging. Am I supposed to be tracking this by adding Drop to the message of the rule when dealing with Drop rules? Thanks!
------------------------------------------------------------------------------ Infragistics Professional Build stunning WinForms apps today! Reboot your WinForms applications with our WinForms controls. Build a bridge from your legacy apps to the future. http://pubads.g.doubleclick.net/gampad/clk?id=153845071&iu=/4140/ostg.clktrk
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Snort Drop Rules Logging PS (Jul 30)
- Re: Snort Drop Rules Logging Joel Esler (jesler) (Jul 30)
- Re: Snort Drop Rules Logging PS (Jul 30)
- Re: Snort Drop Rules Logging Joel Esler (jesler) (Jul 30)