suricata-trafficid.ARCHIVED icon indicating copy to clipboard operation
suricata-trafficid.ARCHIVED copied to clipboard

Published 20 hours ago • verified publisher icon jasonish

Missing rev for rules generated by print_rules

Open sevdog opened this issue 6 years ago • 0 comments

Rules generated with the method print_rules does not have revision number set.

alert http any any -> any any (msg:"SURICATA TRAFFIC-ID: Debian APT-GET"; content:"debian.org"; http_host; content:"Debian APT"; http_user_agent; flow:to_server,established; flowbits:set,traffic/id/debian-apt; flowbits:set,traffic/label/software-update; noalert; sid:300000028;)
alert http any any -> any any (msg:"SURICATA TRAFFIC-ID: Ubuntu APT-GET"; content:"ubuntu.com"; http_host; content:"Debian APT"; http_user_agent; flow:to_server,established; flowbits:set,traffic/id/ubuntu-apt; flowbits:set,traffic/label/software-update; noalert; sid:300000029;)

It should be set to 1 or be a configurable value.

sevdog avatar Dec 13 '17 10:12 sevdog