Notice Protocol Fields

action

The intrusion policy action that was configured for the triggered intrusion policy rule, for example alert, drop, or pass.

gid

The GID of the intrusion rule that triggered the log. This value is collected and displayed even if the rule is disabled.

msg

The message associated with the intrusion rule that triggered the log. This field provides a description of why the flow was logged.

proto

The transport layer protocol associated with the event, for example, IP, ICMP, TCP, or UDP.

rev

The revision number of the intrusion rule that was triggered.

refs

A list of references (URLs) associated with the intrusion rule. These references provide additional information about the specific threat or vulnerability the rule is designed to detect. The references are expanded to full URLs in the log.

sid

The SID of the intrusion rule that triggered the log. This value is collected and displayed even if the rule is disabled.

source

The name of the inspector module that was assigned to process the flow. This identifies the specific component within Snort that detected the anomaly. The name of the module appears similar to that in the Network Analysis Policy.