Snort mailing list archives
metadata questions
From: "Morris, Shane (US SSA)" <shane.morris () baesystems com>
Date: Thu, 30 May 2013 18:32:15 +0000
1. According to the snort manual the metadata key values are engine, soid and service but Ive seen rules written with other options like "metadata: author snortguru". Is there a list of available keys or are all keys other than engine, soid and service treated as comments. 2. If I am writing a rule that I want to fire on HTTP and non-HTTP traffic how could I do this since you have to use metadata and specify a service in the newest version of Snort?
------------------------------------------------------------------------------ Introducing AppDynamics Lite, a free troubleshooting tool for Java/.NET Get 100% visibility into your production application - at no cost. Code-level diagnostics for performance bottlenecks with <2% overhead Download for free and get started troubleshooting in minutes. http://p.sf.net/sfu/appdyn_d2d_ap1
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- metadata questions Morris, Shane (US SSA) (May 30)
- <Possible follow-ups>
- Re: metadata questions Joel Esler (May 30)
- Re: metadata questions Morris, Shane (US SSA) (May 30)
- Re: metadata questions Joel Esler (May 31)
- Re: metadata questions Morris, Shane (US SSA) (May 31)
- Re: metadata questions Joel Esler (May 31)