Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login
    1. Home
    2. Tags
    3. text rules
    Log in to post
    • All categories
    • JonathanLeeJ

      GUIDE: Snort's AppID custom rules Quick Guide to blocking. Example shows OpenAI ChatGPT or Itunes.

      Watching Ignoring Scheduled Pinned Locked Moved IDS/IPS snort appid text rules preprocessors openappid
      29
      12 Votes
      29 Posts
      5k Views
      JonathanLeeJ

      @bmeeks your code is epic !!

    • JonathanLeeJ

      AppID alerts question

      Watching Ignoring Scheduled Pinned Locked Moved IDS/IPS snort appid openappid text rules
      14
      0 Votes
      14 Posts
      1k Views
      JonathanLeeJ

      @michmoor @bmeeks

      Here is, the fully converted appMapping.data to text file...

      Screenshot 2023-10-04 at 5.58.46 PM.jpg

      The pfSense Snort AppID de-cipher sorcerer's code file: --> textrules.txt

      Sid range: 1000000 - 1003371

      Total 3,371 AppID rules you can use with the custom option.

      I converted it with a Java program I just made. The message is the same as the appid match it makes it easier.

      Some of the ieee items are bigger but they seem to match.