Snort mailing list archives

Re: Pulledpork and sid-msg.map


From: Avery Rozar <Avery.Rozar () i-techsupport com>
Date: Wed, 26 Mar 2014 21:25:36 +0000

Will give it a shot, thanks!

Sent from my iPhone 

On Mar 26, 2014, at 2:29 PM, "Jeremy Hoel" <jthoel () gmail com<mailto:jthoel () gmail com>> wrote:

Ok, I would still do it manually before you run pulledpork in the no download mode.  That way you can still get all the 
features of pp without changing it at all.

So basically you could run pp normally then cd to the directory where the rules are (normally /tmp), run the sed 
command and then run pp again with the -n switch.

try that and see if that give you the output you want.


On Wed, Mar 26, 2014 at 6:14 PM, Avery Rozar <Avery.Rozar () i-techsupport com<mailto:Avery.Rozar () i-techsupport 
com>> wrote:
Basically I just want rules that result in drop, to have drop in the msg (my sed script does this for me) so when I'm 
searching alerts, or building charts from the alerts I know if the result was a drop, or just alert.

Sent from my iPhone 

On Mar 26, 2014, at 1:02 PM, "Jeremy Hoel" <jthoel () gmail com<mailto:jthoel () gmail com><mailto:jthoel () gmail 
com<mailto:jthoel () gmail com>>> wrote:

You can use the modify.sid file if you wanted to modify the signature for a rule.. but you want to do it to all of them?

I would probably have something run before you ran pulledpork that changed the rules files; your sed command for 
example, then let pulledpork run off of the existing files ( -n switch, don't have it download new ones).. that way you 
can control the process. I wouldn't change pulledpork.




On Wed, Mar 26, 2014 at 3:05 PM, Avery Rozar <Avery.Rozar () i-techsupport com<mailto:Avery.Rozar () i-techsupport 
com><mailto:Avery.Rozar () i-techsupport com<mailto:Avery.Rozar () i-techsupport com>>> wrote:
Is it safe to assume when using pulledpork the msg field in the snort.rules gets pulled into the sid-msg.map for 
barnyard2 to write into the alert?

If so, where in the pulledpork.pl<http://pulledpork.pl><http://pulledpork.pl> script should I add a shell script to add 
drop into the msg field. I can run this [sed -i '/^drop/s/(msg:"/(msg:"drop - /‘ /etc/snort/rules/snort.rules] in a 
shell script and adds the drop into the msg field, but I need to do this before the sid-msg.map is generated for this 
to work.

I’ve added the following command in two places with no luck.

system ("sh /opt/scripts/./add_drop_msg.sh”);


At the end of [sub rule_write]

If I put it here it will write drop in the msg on the snort.rules, but not sid-msg.map.


At the beginning of [sub sid_write]

If I put it here it will write drop in the msg on the snort.rules, but not sid-msg.map.

------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and their
applications. Written by three acclaimed leaders in the field,
this first edition is now available. Download your free book today!
http://p.sf.net/sfu/13534_NeoTech
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net<mailto:Snort-users () lists sourceforge net><mailto:Snort-users () lists 
sourceforge net<mailto:Snort-users () lists sourceforge net>>
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!


------------------------------------------------------------------------------
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Current thread: