Snort_AIPreproc/corr_rules/1-469-4.xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE hyperalert PUBLIC "-//blacklight//DTD HYPERALERT SNORT MODEL//EN" "http://0x00.ath.cx/hyperalert.dtd">

<hyperalert>
	<snort-id>1.469.4</snort-id>
	<desc>ICMP PING NMAP</desc>
	<post>HostExists(+DST_ADDR+)</post>
</hyperalert>
10 sept 2010 commit 2010-09-11 02:12:39 +02:00			`<?xml version="1.0" encoding="UTF-8"?>`
Supporting manual (un)correlations from web interface 2010-10-14 02:45:31 +02:00			`<!DOCTYPE hyperalert PUBLIC "-//blacklight//DTD HYPERALERT SNORT MODEL//EN" "http://0x00.ath.cx/hyperalert.dtd">`
10 sept 2010 commit 2010-09-11 02:12:39 +02:00
			`<hyperalert>`
			`<snort-id>1.469.4</snort-id>`
Correlation graphs, macro substitution improved 2010-09-14 19:24:03 +02:00			`<desc>ICMP PING NMAP</desc>`
10 sept 2010 commit 2010-09-11 02:12:39 +02:00			`<post>HostExists(+DST_ADDR+)</post>`
			`</hyperalert>`