Project

General

Profile

Bug #163

Add snort classification.reference to Snort.org site

Added by about 18 years ago. Updated almost 18 years ago.

Status:
Closed
Priority:
Normal
Category:
snort
Target version:
-
Start date:
Due date:
% Done:

0%

Resolution:
fixed

Description

Snort Prelude output should provide an implicit classification.reference entry for SIDs less than 100000 (higher than this are likely to be Bleedingsnort or custom rulesets).
For an example rule 1742, this URL would look like this:

http://www.snort.org/pub-bin/sigs.cgi?sid=1742

Form an example resulting IDMEF classification.reference like this:

classification.reference(0).origin=vendor-specific; \
classification.reference(0).meaning=Snort SID; \
classification.reference(0).name=1742; \
classification.reference(0).url=http://www.snort.org/pub-bin/sigs.cgi?sid=1742; \

History

#1 Updated by Yoann VANDOORSELAERE almost 18 years ago

  • Status changed from New to Assigned

Status: Patch sent to the Snort team.

#2 Updated by Yoann VANDOORSELAERE almost 18 years ago

  • Status changed from Assigned to Closed
  • Resolution set to fixed

Scheduled for Snort 2.6.0.1. Marking bug as closed.

Also available in: Atom PDF