Re: Classification.config file doubt.

[Erek Adams <erek () theadamsfamily net>]

On Thu, 15 Nov 2001, Sonika Malhotra wrote:

> Hello List,

Hello Sonika!

>         I have installed snort1.8.1 on Linux-2.2.14.

Well....  First off:  Upgrade to to 1.8.2  (1.8.3 will be out Real Soon Now!)
Secondly:  I'm sorry you are on Linux.  :)  You know you can download Solaris
x86 for free....  ;-)

[ Bigot Disclaimer:  I'm not a Linux fan.  It just ain't my bag, Baby!  And
apolgies to Austin Powers for stealing his line....  ;-)  ]


> The classification.config file has different class-types and their
> priorities. I want to know more in this direction.How do i define a
> class-type and its priority, can i customize this, so that i am able to
> classify attacks in high,medium,low categories. and also i want to b
> e-mailed if a high-priority risk attack is found.(i donot need an e-mail
> for all low/medium risks).Any pointers?

Well, classification.config has been hashed out a lot recently (see the thread
on 'Professionalism' in the archives.  :-).  But it's basically, pretty
simple.

> From the classification.config in CVS:

--
# Each classification includes a shortname, a description, and a default
# priority for that classification.
#
# This allows alerts to be cassified and prioritized.  You can specify
# what priority each classification has.  Any rule can override the default
# priority for that rule.
#
# Here are a few example rules:
#
#   alert TCP any any -> any 80 (msg: "EXPLOIT ntpdx overflow";
#       dsize: > 128; classtype:attempted-admin; priority:10;
#
#   alert TCP any any -> any 25 (msg:"SMTP expn root"; flags:A+; \
#             content:"expn root"; nocase; classtype:attempted-recon;)
#
# The first rule will set its type to "attempted-admin" and override
# the default priority for that type to 10.
#
# The second rule set its type to "attempted-recon" and set its
# priority to the default for that type.
#
#
# config classification:shortname,short description,priority
#
---

You simply define a shortname, a description to go along with it, and then a
priority to go along with it.  You then use that classification in your
rulesets.

As for the email alerts, two answers:

http://www.snort.org/docs/faq.html#5.7

And:  There has been a patch submited that adds email alerts.  I've not
implemented this yet, so I can't speak well on it.  Check the snort-dev list
archives for a thread on it.  It was within the last few days...  You would
also have to define a custom rule that would use the email and normal alerts
(see snort.conf for the 'redalert' example).

Cheers!

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users