Rules where msg contains ":" don't appear correctly about py-idstools HOT 10 CLOSED

Correction, that's the signature field..I have it named as ids_alert :)

from py-idstools.

Are you pointing the script at the full rules, or just the sig-msg.map?

from py-idstools.

Oh...I'm point it everywhere :)

/usr/bin/python /opt/py-idstools/bin/idstools-u2eve -C /opt/etc/snort/classification.config -S /opt/etc/snort/sid-msg.map -G /opt/etc/snort/gen-msg.map --bookmark --follow --directory /opt/var/log/bleh --prefix bleh --packet-printable --output /tmp/blehunified.json

Every other rule shows up fine, but just not the SN: ones.

from py-idstools.

Can you check your sid-msg.map and make sure the rule message is correct there? I've added unit tests to the rule, and sid-msg.map parser and am not able to replicate this.

from py-idstools.

As it appears in the sid-msg.map:

71918985 || SN || url,https

Sparse, to be sure ;) Thanks Jason.

from py-idstools.

What created your sid-msg.map?

from py-idstools.

from py-idstools.

Ok, might want to raise a bug over there. In the mean time you could use idstools-gensidmsgmap to regenerate your sid-msg.map file. Something like:

idstools-gensidmsgmap ./rules ./so_rules ./preproc_rules > sid-msg.map

from py-idstools.

Closing as note an idstools issue, but I did add tests for these cases.

from py-idstools.

Ok cool thanks Jason.

from py-idstools.