Next: 4.16 What about `SMB
Up: 4 Rules and Alerts
Previous: 4.14 Why do certain
The quick answer to this question is no. ACID is at the mercy of the
underlying database, since Snort doesn't assign priorities, ACID does not
have priorities. Nevertheless, there are several work-arounds:
- It is possible to enforce priorities of sort at the database level by
writing alerts of different severity to separate databases. For example,
critical alerts such as buffer overflows can be written to one database,
while scan alerts can be written to another. Then load two different versions
of ACID, each pointing to a different instance of the database.
- With manual intervention Alert Groups (AG) can be used to assign priority.
Essentially, this strategy entails creating an AG for each severity level and
manually moving the alerts as they arrive into the appropriate group.
|
