Search Criteria for Intrusion Rules

Signature ID

To search for a single rule based on Snort ID (SID), enter an SID number. To search for multiple rules, enter a comma-separated list of SID numbers. This field has an 80-character limit.

Generator ID

To search for standard text rules, select 1. To search for shared object rules, select 3.

Message

To search for a rule with a specific message, enter a single word from the rule message in the Message field. For example, to search for DNS exploits, you would enter DNS, or to search for buffer overflow exploits, enter overflow.

Protocol

To search rules that evaluate traffic of a specific protocol, select the protocol. If you do not select a protocol, search results contain rules for all protocols.

Source Port

To search for rules that inspect packets originating from a specified port, enter a source port number or a port-related variable.

Destination Port

To search for rules that inspect packets destined for a specific port, enter a destination port number or a port-related variable.

Source IP

To search for rules that inspect packets originating from a specified IP address, enter a source IP address or an IP address-related variable.

Destination IP

To search for rules that inspect packets destined for a specified IP address, enter a destination IP address or an IP address-related variable.

Keyword

To search for specific keywords, you can use the keyword search options. You select a keyword and enter a keyword value for which to search. You can also precede the keyword value with an exclamation point (!) to match any value other than the specified value.

Category

To search for rules in a specific category, select the category from the Category list.

Classification

To search for rules that have a specific classification, select the classification name from the Classification list.

Rule State

To search for rules within a specific policy and a specific rule state, select the policy from the first Rule State list, and choose a state from the second list to search for rules set to Generate Events, Drop and Generate Events, or Disabled.