Toronto Web Hosting - Snort Intrusion Dection Guide

 | A string representing a tcpdump filter that is normally passed

 | in on the command line. e.g. "not net 10.1.1.0/24"

 | The signature is free form text describing the event. In snort,

 | it is the string contained in the "msg" rule option

 | signature attributes

 |  id       = unique identifier of this signature (0..2^32 1)

 |  revision = revision number of this signature

 |  class    = classification identifier of this signature (numeric)

 |  priority = numeric priority of this event   (0..255)

          id           CDATA   #IMPLIED

          revision     CDATA   #IMPLIED

          class        CDATA   #IMPLIED

          priority     CDATA   #IMPLIED

 | A reference provides a mechanism to refer to an external

 | database for information related to this signature or event.

 | reference attribute

 |    system   = the external database referenced

 |                  cve       : Common Vulnerabilities and Exposures

 |                              (http://cve.mitre.org)

 |                  bugtraq   : Bugtraq

 |                              (http://www.securityfocus.com/bid)

 |                  arachnids : arachNIDS

 |                              (http://www.whitehats.com/ids)

 |                  mcafee    : McAfee

 |                              (http://vil.nai.com)

 |                  url       : custom URL

          system    CDATA    #REQUIRED

footer