Re: sid-msg.map incomplete again

[Paul Halliday <paul.halliday () gmail com>]

On Tue, Jan 25, 2011 at 4:28 PM, Nigel Houghton
<nhoughton () sourcefire com> wrote:
> On Tue, 25 Jan 2011 14:30:44 -0500, Lawrence R. Hughes, Sr. wrote:
> > Nigel,

> If you don't want to use PulledPork, it is pretty easy to write a
> script (in whatever language you like) that processes the rules files
> to produce a sid-msg.map.

Oinkmaster comes with a script that will take care of it:

~% ./create-sidmap.pl

Parse active rules in *.rules in one or more directories and create a SID
map. Result is sent to standard output, which can be redirected to a
sid-msg.map file.

Usage: ./create-sidmap.pl <rulesdir> [rulesdir2, ...]

Quick, easy.

-- 
Paul Halliday
http://www.pintumbler.org

------------------------------------------------------------------------------
Special Offer-- Download ArcSight Logger for FREE (a $49 USD value)!
Finally, a world-class log management solution at an even better price-free!
Download using promo code Free_Logger_4_Dev2Dev. Offer expires 
February 28th, so secure your free ArcSight Logger TODAY! 
http://p.sf.net/sfu/arcsight-sfd2d
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users