Snort mailing list archives
Re: Bleeding Edge rules and Barnyard
From: Bamm Visscher <bamm.visscher () gmail com>
Date: Wed, 19 Oct 2005 09:54:17 -0600
Just merge your sid-msg.maps into one file. I generally just creat a sid-msg.map using create-sidmap.pl from oinkmaster. Bammkkkk On 10/19/05, Paul Melson <pmelson () gmail com> wrote:
I've just added Barnyard to the mix on one of my sensors, but I'm running into a problem. I would like to continue to run the Bleeding Edge rules on this sensor, but it seems as though Barnyard limits me to a single sid-msg-map parameter in the config file. With this set to the standard Snort/Sourcefire sid-msg.map file, my Bleeding Edge alerts are showing up as "Snort Alert [1:2000328:0]" instead of "BLEEDING-EDGE POLICY Outbound Multiple Non-SMTP Server Emails". Is there a solution, or is Barnyard still not ready for prime time? Thanks, PaulM ------------------------------------------------------- This SF.Net email is sponsored by: Power Architecture Resource Center: Free content, downloads, discussions, and more. http://solutions.newsforge.com/ibmarch.tmpl _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
-- sguil - The Analyst Console for NSM http://sguil.sf.net ------------------------------------------------------- This SF.Net email is sponsored by: Power Architecture Resource Center: Free content, downloads, discussions, and more. http://solutions.newsforge.com/ibmarch.tmpl _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Bleeding Edge rules and Barnyard Paul Melson (Oct 19)
- Re: Bleeding Edge rules and Barnyard Bamm Visscher (Oct 19)