Hi,
I'm interested in applying some of the "bleeding edge" rules that are published in the snort mailing lists. These rules seem particularly good for Day 0 attacks.
I've tried a couple of times to map these rules to the "New Rule" page on ASL, but have had no luck.
Can someone help me out?
The "New Rule" setup is looking for three things:
1) Description
2) Selector
3) Filter
Here is an example of a rule that is published:
2001759 || BLEEDING-EDGE Virus Beagle.BK - outbound || url,securityresponse.symantec.com/avcenter/venc/data/w32.beagle.bk@mm.html
Can someone help me map the three to this rule?
Thanks
This thread was automatically locked due to age.
