Skip to content
Discussion options

You must be logged in to vote

Looks like your last rule is missing : after the sid
alert icmp any any -> $HOME_NET any (msg:"ICMP Test"; sid:1000004; rev:1;)

I went and added those rules to my idstools -> rules -> local rules

alert icmp any any -> any any (msg:"ICMP Testing Rule"; sid:1000001; rev:1;)
alert tcp any any -> any any (msg:"TCP Testing Rule"; sid:1000002; rev:1;)
alert udp any any -> any any (msg:"UDP Testing Rule"; sid:1000003; rev:1;)
alert icmp any any -> $HOME_NET any (msg:"ICMP Test"; sid:1000004; rev:1;)

Then clicked the 'Synchronize grid' button at the top of SOC and I started to get alerts for the new rules (after about 15 minutes for the grid sync to complete)

Replies: 2 comments

Comment options

You must be logged in to vote
0 replies
Answer selected by Lesterol
Comment options

You must be logged in to vote
0 replies
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
2 participants