mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-08 18:22:47 +01:00
15 lines
490 B
Plaintext
15 lines
490 B
Plaintext
# idstools-rulecat - modify.conf
|
|
|
|
# Format: <sid> "<from>" "<to>"
|
|
|
|
# Example changing the seconds for rule 2019401 to 3600.
|
|
#2019401 "seconds \d+" "seconds 3600"
|
|
|
|
# Change all trojan-activity rules to drop. Its better to setup a
|
|
# drop.conf for this, but this does show the use of back references.
|
|
#re:classtype:trojan-activity "(alert)(.*)" "drop\\2"
|
|
|
|
# For compatibility, most Oinkmaster modifysid lines should work as
|
|
# well.
|
|
#modifysid * "^drop(.*)noalert(.*)" | "alert${1}noalert${2}"
|