Re: Snort as IPS and correlation

["lists () packetmail net" <lists () packetmail net>]

On 04/10/2015 11:26 AM, Daniel Lopez wrote:
> Is this possible?

Yes

> How can I do it?

You'll have to develop your own script, I've done this in Perl with hashes.  Hit
me up off-list and I can do some code sharing with you.

> Is there any other way to perform this?

Not that I'm aware of, but I defer to the expertise of the list.

Cheers,
Nathan Fowler

------------------------------------------------------------------------------
BPM Camp - Free Virtual Workshop May 6th at 10am PDT/1PM EDT
Develop your own process in accordance with the BPMN 2 standard
Learn Process modeling best practices with Bonita BPM through live exercises
http://www.bonitasoft.com/be-part-of-it/events/bpm-camp-virtual- event?utm_
source=Sourceforge_BPM_Camp_5_6_15&utm_medium=email&utm_campaign=VA_SF
_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
http://www.snort.org


Please visit http://blog.snort.org for the latest news about Snort!