Snort mailing list archives
Re: metadata questions
From: Joel Esler <jesler () sourcefire com>
Date: Thu, 30 May 2013 14:51:34 -0400
On May 30, 2013, at 2:32 PM, "Morris, Shane (US SSA)" <shane.morris () baesystems com> wrote:
1. According to the snort manual the metadata key values are engine, soid and service but Ive seen rules written with other options like “metadata: author snortguru”. Is there a list of available keys or are all keys other than engine, soid and service treated as comments.
It's a free flowing text field. The only field that Open Source Snort uses is "service", and only if you have Adaptive profiling turned on with a host attribute table.
2. If I am writing a rule that I want to fire on HTTP and non-HTTP traffic how could I do this since you have to use metadata and specify a service in the newest version of Snort?
Can you give me an example? (you only have to specify a service in the >=5.x Sourcefire product, this does not effect Open Source Snort) -- Joel Esler Senior Research Engineer, VRT OpenSource Community Manager Sourcefire
------------------------------------------------------------------------------ Introducing AppDynamics Lite, a free troubleshooting tool for Java/.NET Get 100% visibility into your production application - at no cost. Code-level diagnostics for performance bottlenecks with <2% overhead Download for free and get started troubleshooting in minutes. http://p.sf.net/sfu/appdyn_d2d_ap1
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- metadata questions Morris, Shane (US SSA) (May 30)
- <Possible follow-ups>
- Re: metadata questions Joel Esler (May 30)
- Re: metadata questions Morris, Shane (US SSA) (May 30)
- Re: metadata questions Joel Esler (May 31)
- Re: metadata questions Morris, Shane (US SSA) (May 31)
- Re: metadata questions Joel Esler (May 31)