Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    OpenApp ID alerts not displaying

    Scheduled Pinned Locked Moved IDS/IPS
    4 Posts 2 Posters 317 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • L
      Libertas
      last edited by

      I have configured pfSense with Snort and OpenApp ID, I have enable Sourcefire OpenAppID Detectors and APPID Open rules on the Global Settings. Additionally have enabled OpenAppID to detect various applications and OpenAppID statistics logging for the specific interface desired. And have restarted the snort interface multiple times. This pfSense machine is running on a Hyper-V Server 2019 host with 4GBs of RAM. Any other ideals where to check to solve this? Thanks.

      1 Reply Last reply Reply Quote 0
      • bmeeksB
        bmeeks
        last edited by

        Did you also enable one or more of the various OpenAppID rule categories on the CATEGORIES tab and did you enable the OpenAppID preprocessor on the PREPROCESSORS tab?

        You must do several things to use OpenAppID. See the docs here: https://docs.netgate.com/pfsense/en/latest/ids-ips/setup-snort-package.html#application-id-detection-with-openapp-id.

        1 Reply Last reply Reply Quote 1
        • L
          Libertas
          last edited by

          The OpenAppID preprocessor is enable, however I am using the Security IPS selection group so I am not manually selecting the categories. I guess I can't use the IPS selection groups?

          1 Reply Last reply Reply Quote 0
          • L
            Libertas
            last edited by

            So I change the setting from IPS Selection group to manual configuration and was able to start logging App info. Thanks for the recommendation and will be looking into the possibility of customizing the IPS selection groups.

            1 Reply Last reply Reply Quote 0
            • First post
              Last post
            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.