How to find rule which have sid,des alert?
-
Hi all,
Currently, I have alerts with SID,desc,…
So how can I know it from what category rule ?Thanks.
-
+1
-
There once was a web site out there where you could do that (match a GID:SID with category). I'm not sure it exists or is maintained anymore. I no longer have the URL.
You can open a CLI prompt on the firewall and use grep to find a GID:SID within the rules. To search all the available categories, grep all the *.rules files in this directory for Snort:
/usr/local/etc/snort/rules/
If you have Suricata instead, then search the files in this directory:
/usr/local/etc/suricata/rules/
Bill
