Home page logo

snort logo Snort mailing list archives

Re: How to extract part of “content ” and print in “msg” of a Snort Alert
From: Jason Haar <Jason_Haar () trimble com>
Date: Thu, 18 Apr 2013 16:21:38 +1200

On 16/04/13 02:59, Joel Esler wrote:

This is not a feature that Snort /currently/ supports in any version.

I'm glad to see the emphasis there Joel ;-)

FYI I implemented it here by getting our alerting script to call the
BASE interface (damned if I was going to figure out the SQL-foo to do
this!) to get the TEXT output from the pcap - and then fiddle that new
data into the alert

You don't need to tell me how horrendous that is - but it works ;-)

Please feel free to save me from going to coders-hell by doing it
natively ;-)


Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +1 408 481 8171
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

Precog is a next-generation analytics platform capable of advanced
analytics on semi-structured data. The platform includes APIs for building
apps and a phenomenal toolset for data science. Developers can use
our toolset for easy data analysis & visualization. Get a free account!
Snort-sigs mailing list
Snort-sigs () lists sourceforge net

Please visit http://blog.snort.org for the latest news about Snort!

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]