Thursday, June 25, 2009

BASE / ACID outdated reference links - a fix

Recently, with changes to the site, the Snort mailing lists have been quite inundated with questions about the link to the SID reference and how it is no more. As a partial means of compensating for this and to help the community, we have recently added an up-to-date tool at that will allow for you to once again have a valid snort reference link.

In BASE, simply locate the following section of your base_conf.php:
/* Signature references */
$external_sig_link = array('bugtraq' => array('', ''),
'snort' => array('', ''),
'cve' => array('', ''),
'arachnids' => array('', ''),
'mcafee' => array('', '.htm'),
'icat' => array('', ''),
'nessus' => array('', ''),
'url' => array('http://', ''),
'local' => array('signatures/', '.txt'));

and modify the 'snort' line to match:
'snort' => array('', ''),
Once this is done, you are all set, the snort documentation link will now take you to and display the info for that SID.

Obviously if you want to do this in other applications, simply point them to where xxxxx is the SID that you want to know about. ex:



Anthony Camilo said...

I figured out how to fix this using the snort site

JJC said...

Yeah, the search was re-added to the site a couple of days ago!