snort log with SID

dwarf007 · 08-08-2006, 02:18 AM

Is anyone knows how to generate Snort alert file with sid output? This is because I can refer to the SID and look for a solution and info detail of the attack in the doc library.

Anyone knows, plaease help
Thank you.....

bmeckle · 08-08-2006, 02:40 PM

The SID should be in the alert it's self. It is laid out in a manner that might be confusing but it should look something like this.

[**] [1:2050:9] MS-SQL version overflow attempt [**]
blah, blah, blah

The SID is "2050".

Hope that helps.

dwarf007 · 08-10-2006, 01:50 AM

Thanks man, u r the best