Re: Unified log format.

[Martin Roesch <roesch () sourcefire com>]

Hi Chris,

The only "limitation" with the unified formats is that you need to use 
a program (or manual lookup) to figure out what the alert name that's 
in an event is.

     -Marty

On Jan 16, 2004, at 9:50 PM, Chris Keladis wrote:

> Hi,
>
> I read somewhere that there is a limitation in the unified output 
> format, which currently prevents it from passing alerts that the 
> pre-processors generate (or something similar)..
>
> I was wondering if someone could expand on what the issues are exactly?
>
> Looking at spo_unified.c structs seems to have the expected stuff such 
> as 'Event' members, etc..
>
> Hopefully someone could clarify.
>
>
>
>
>
> Thanks!
>
> Chris.
>
>
>
> -------------------------------------------------------
> The SF.Net email is sponsored by EclipseCon 2004
> Premiere Conference on Open Tools Development and Integration
> See the breadth of Eclipse activity. February 3-5 in Anaheim, CA.
> http://www.eclipsecon.org/osdn
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
--
Martin Roesch - Founder/CTO, Sourcefire Inc. - (410)290-1616
Sourcefire: Intelligent Security Monitoring
roesch () sourcefire com - http://www.sourcefire.com
Snort: Open Source Network IDS - http://www.snort.org



-------------------------------------------------------
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Development and Integration
See the breadth of Eclipse activity. February 3-5 in Anaheim, CA.
http://www.eclipsecon.org/osdn
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users