|
|
|
|
Snort Forums Archive
Archive Home » Snort Development » Database output plugin and gen_id
Please note that the categories listed below represent an archived version of our forums pages. To view the current version and be able to post and reply to threads, please register and login here to go to the full forums pages.
[ Notice: Full Version of This Topic ]
Database output plugin and gen_id
Posted by reshuck on April 15, 2005 06:21:35
Is it possible (easy) to get the gen_id added to the signature table output of the database plugin? This would allow a minor tweak to ACID (line 168 of acid_signature.inc) and the alerts with gen_ids other than 1 could be referenced back to the Snort.org Rule database.
|
|
Posted by roesch on June 28, 2005 12:22:07
The GID is in the same event struct that spo_database uses to construct its event records, adding it to the database should be trivial (assuming you update the schemas appropriately).
-Marty
|
|
|
|
|
|
