INSTALACIÓN Y CONFIGURACIÓN DE SURICATA IDS/IPS – PARTE 4

https://bitsymegas.wordpress.com/2015/12/23/instalacion-y-configuracion-de-suricata-idsips-parte-4/

Si creases una regla de esta forma:

alert http any any -> any any (msg:”Do not read gossip during work”; content:”Scarlett”; nocase; classtype:policy-violation; sid:1; rev:1;)

La alerta debería ser así:

09/15/2011-16:50:27.725288  [**] [1:1:1] Do not read gossip during work [**] [Classification: Potential Corporate Privacy Violation] [Priority: 1] {TCP} 192.168.0.32:55604 -> 68.67.185.210:80