Thursday, November 05, 2009

How to Fix Snort sid search links in BASE

The website was re-designed in the past few months leaving BASE users with broken links to search for snort signature id's (SID). I discovered today that they had a working rules search at the site and figured out what the proper URL to do searches from BASE is.

Edit base_conf.php and replace the line that says:
'snort'     => array('', ''),
'snort'     => array('', ''),
or (Thanks Anonymous)

'snort'     => array('', ''),

Their search is still broken, so on ocassion you will get a 500 error, but if you refresh a few times, the signature description will show up.

1 comment:

  1. You can also directly link to something like (putting in the gid and sid you desire). It will also assume GID=1 for regular SIDs