Re: Snort Alert Description in BASE

[chris mr <chris.misztur () yahoo com>]

Yup. create-sidmap.pl solved the issue.

thanks

----- Original Message ----
From: David J. Bianco <david () vorant com>
To: chris mr <chris.misztur () yahoo com>; snort-users () lists sourceforge net
Sent: Thursday, September 13, 2007 1:37:25 PM
Subject: Re: [Snort-users] Snort Alert Description in BASE


That's barnyard's job, so probably you haven't told it where to find the
sid-msg.map file, either on the command line or in the config file.
And every time you update the file, you need to restart barnyard so it
can reread all those lines.

    David

chris mr wrote:
> I downloaded bleeding-edge rulesets and set them up in snort.conf. I also CAT sid-msg.map with 
> bleeding-sid-msg-map.txt. 
>
> However, when I open BASE I still get a generic Snort Alert... How can these be replaced with detail info on the 
> signature? 
>
>
> [local] [snort] Snort Alert [1:2002872:0] policy-violation 1(0%) 1 1 1 2007-09-13 17:42:39 2007-09-13 17:42:39 
>
>
>
> Thanks 
> chris.
>
>
>       ____________________________________________________________________________________
> Luggage? GPS? Comic books? 
> Check out fitting gifts for grads at Yahoo! Search
> http://search.yahoo.com/search?fr=oni_on_mail&p=graduation+gifts&cs=bz
>
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Microsoft
> Defy all challenges. Microsoft(R) Visual Studio 2005.
> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


      ____________________________________________________________________________________
Tonight's top picks. What will you watch tonight? Preview the hottest shows on Yahoo! TV.
http://tv.yahoo.com/ 


-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users