Re: question about Sid 1-30793

["Joel Esler \(jesler\) via Snort-sigs" <snort-sigs () lists snort org>]

Let's redirect this internally?

On Dec 19, 2019, at 4:35 PM, Beau Barnett (bebarnet) via Snort-sigs <snort-sigs () lists snort org<mailto:snort-sigs () 
lists snort org>> wrote:

Please advise if this is not the correct venue for this question

Customer is requesting “signature for 1-30793:3”

When I search for that SID all I find is 1-30793:4 – is there a big difference in the signatures? Customer states:  
“Firepower Signature not Detecting Malicious Traffic - 1-30793:4”

I requested a pcap file of his tests and I have attached to this email.

Thanks in advance for any assistance.

Best Regards,

Beau Barnett
HTTS Engineer/Security CX Americas US Public Sector
Customer Experience
.:|:.:|:. Cisco Systems, Inc.
bebarnet () cisco com<mailto:bebarnet () cisco com>
Phone: +1 984 216 4810


If you need assistance outside my normal hours please call +1 (866) 748-0639 and ask that your case be requeued
Your satisfaction is our number one priority. If you would like to speak to my manager for any reason please feel free 
to contact him directly:

Ryan Schaefer , HTTS Lead CX Americas US Public Sector  ryschaef () cisco com<mailto:ryschaef () cisco com>  +1 408 922 
4713

        ,,_
    o"     )~                 .:|:.:|:.
       ' ' ' '

<request_1561474214.pcap>_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists snort org<mailto:Snort-sigs () lists snort org>
https://lists.snort.org/mailman/listinfo/snort-sigs

Please visit http://blog.snort.org<http://blog.snort.org/> for the latest news about Snort!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

Visit the Snort.org<http://snort.org/> to subscribe to the official Snort ruleset, make sure to stay up to date to 
catch the most <a href=" https://snort.org/downloads/#rule-downloads";>emerging threats</a>!

_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists snort org
https://lists.snort.org/mailman/listinfo/snort-sigs

Please visit http://blog.snort.org for the latest news about Snort!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

Visit the Snort.org to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a 
href=" https://snort.org/downloads/#rule-downloads";>emerging threats</a>!