|
Title: Better search for snort rules Post by: Ricard on Saturday 29 March 2014, 04:21:18 am Search engine of the snort rules is quite useless and hard to use. It would be great if we can search a rule according log alerts.
In example, we see this alert in the log window: snort[15224]: [1:2003195:5] ET POLICY Unusual number of DNS.... and the related rule is this: 2003195 ET POLICY Unusual number of DNS No Such Name Responses However, a search using the GUI is unable to find "2003195" or any other related text of that alert. The search field only is able to find the name of the snort rule category ("POLICY"). In some cases it forces to a search across many pages of the category. This is very slow. |