|
|
|
|
Snort Forums Archive
Archive Home » Rules » 'Real' dynamic rules??
Please note that the categories listed below represent an archived version of our forums pages. To view the current version and be able to post and reply to threads, please register and login here to go to the full forums pages.
[ Notice: Full Version of This Topic ]
'Real' dynamic rules??
Posted by Trowelfaz on March 16, 2005 17:29:40
I didn't see anything in the docs or by trial-and-error, but is there a way (or maybe in a future release) to have trigger type rules? That is, an extension/redefine of the activate/dynamic rules. In this case, a snort rule could trigger and an alert would not be generated unless an associated rule is matched.
For example:
An HTTP rule that triggers on somescript.cgi would go in to a 'need more info' mode
Next, another rule is only activated IF the HTTP rule above is set to watch. In this case, it looks for 'password=' somewhere in the URI other rules could be parsed in a top-down fashion looking for other things in the URI, each with their own options to log additional packets, log or alert.
HTTP was used as a example, but you should get the idea. |
|
Posted by roesch on March 19, 2005 17:55:55
Have you checked out the flowbits rule option? Sounds like it might do what you want. Check out the README.flowbits file in the doc directory.
-Marty
|
|
|
|
|
|
