Project

General

Profile

Feature #609

Active Response in inline mode (like react in snort 2.9+)

Added by Dmitry Vlasov about 7 years ago. Updated 9 months ago.

Status:
New
Priority:
Normal
Target version:
Effort:
high
Difficulty:
medium
Label:

Description

Rule option keyword that enables sending an HTML page on a session and then resetting it

Example rule:
drop tcp any any -> any 80 (msg:"http://bad.url"; content:"Host: bad.url"; react: msg; sid:283; rev:1;)

http://manual.snort.org/node26.html#SECTION003114000000000000000

History

#1

Updated by Victor Julien about 6 years ago

  • Target version set to TBD
#2

Updated by Andreas Herz almost 4 years ago

  • Assignee set to OISF Dev
#3

Updated by Victor Julien almost 4 years ago

  • Assignee changed from OISF Dev to Anonymous
#4

Updated by Victor Julien over 1 year ago

  • Effort set to high
  • Difficulty set to medium
#5

Updated by Andreas Herz 9 months ago

  • Assignee set to Community Ticket

Also available in: Atom PDF