How to find rule which have sid,des alert?



  • Hi all,
    Currently, I have  alerts with SID,desc,…
    So how can I know it from what category rule ?

    Thanks.



  • +1



  • There once was a web site out there where you could do that (match a GID:SID with category).  I'm not sure it exists or is maintained anymore.  I no longer have the URL.

    You can open a CLI prompt on the firewall and use grep to find a GID:SID within the rules.  To search all the available categories, grep all the *.rules files in this directory for Snort:

    /usr/local/etc/snort/rules/

    If you have Suricata instead, then search the files in this directory:

    /usr/local/etc/suricata/rules/

    Bill