Snort mailing list archives
Changing a Classification
From: "Graham, Robert" <rgraham () mem-ins com>
Date: Wed, 15 Jan 2003 12:31:15 -0600
I created a new classification to replace "kickass-porn" with a classification of just "Porn". I gave it a description and priority and changed the classtype to Porn in the signatures and restarted snort. The result of this caused some signatures to classify it as "Porn" and some to classify it as "kick-Ass Porn". I double checked the classtype and they are all set to "Porn". I then deleted the "kickass-Porn" classification, restarted snort, and now it reports some of the porn alerts as classification "-" and others as "Porn". What I'm I doing wrong?
Current thread:
- Changing a Classification Graham, Robert (Jan 16)
- <Possible follow-ups>
- Changing a Classification Graham, Robert (Jan 18)
- Changing a Classification Graham, Robert (Jan 23)
- RE: Changing a Classification Graham, Robert (Jan 24)