Show specific rule in reference links?
Brought to you by:
secureideas,
sinukas
Menu
▾
▴
Hi,
after spending some time working with BASE, i've got something like a feature proposal.
It's pretty usefull to have the full text string of an alerting rule in mind when analysing its alarms.
It's not a problem to grep 'em myself, but an integration into the reference link system of base would make it faster and accessable through http(s) without the need of a shell account.
The SID of a rule is known, and a local file search for (not *in*) the local signature files is implemented as well. I have something like a "grep -r SID <path_to_rules>" in mind, but have no idea how complex the reference system in base really is and how diificult the affordable changes are.
It's just a proposal anyway ;o)
Cheers,
Chris.
Sounds like a decent idea. The reference system is not very complex. I can look at this in my spare time or someone with more time is welcome to it. :)
Kevin
Hello Chris,
done in CVS. You will most probably run into permission problems. So I recommend you copy your rules directory directly into the base directory and make it readable and executable for "others".
Then set the "local_rules_dir" in base_conf.php accordingly. A "[rule]" should appear as a result.
Bye, bye
Juergen