Bleeding Edge rules and Barnyard

["Paul Melson" <pmelson () gmail com>]

I've just added Barnyard to the mix on one of my sensors, but I'm running
into a problem.  I would like to continue to run the Bleeding Edge rules on
this sensor, but it seems as though Barnyard limits me to a single
sid-msg-map parameter in the config file.  With this set to the standard
Snort/Sourcefire sid-msg.map file, my Bleeding Edge alerts are showing up as
"Snort Alert [1:2000328:0]" instead of "BLEEDING-EDGE POLICY Outbound
Multiple Non-SMTP Server Emails". 

Is there a solution, or is Barnyard still not ready for prime time?

Thanks,
PaulM




-------------------------------------------------------
This SF.Net email is sponsored by:
Power Architecture Resource Center: Free content, downloads, discussions,
and more. http://solutions.newsforge.com/ibmarch.tmpl
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users