Bug #163
Add snort classification.reference to Snort.org site
Start date:
Due date:
% Done:
0%
Resolution:
fixed
Description
Snort Prelude output should provide an implicit classification.reference entry for SIDs less than 100000 (higher than this are likely to be Bleedingsnort or custom rulesets).
For an example rule 1742, this URL would look like this:
http://www.snort.org/pub-bin/sigs.cgi?sid=1742
Form an example resulting IDMEF classification.reference like this:
classification.reference(0).origin=vendor-specific; \
classification.reference(0).meaning=Snort SID; \
classification.reference(0).name=1742; \
classification.reference(0).url=http://www.snort.org/pub-bin/sigs.cgi?sid=1742; \
History
#1 Updated by Yoann VANDOORSELAERE almost 18 years ago
- Status changed from New to Assigned
Status: Patch sent to the Snort team.
#2 Updated by Yoann VANDOORSELAERE almost 18 years ago
- Status changed from Assigned to Closed
- Resolution set to fixed
Scheduled for Snort 2.6.0.1. Marking bug as closed.