Snort_AIPreproc/corr_rules/122-1-0.xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE hyperalert PUBLIC "-//blacklight//DTD HYPERALERT SNORT MODEL//EN" "http://0x00.ath.cx/hyperalert.dtd">

<hyperalert>
	<snort-id>122.1.0</snort-id>
	<desc>(portscan) TCP Portscan</desc>

	<pre>HostExists(+DST_ADDR+)</pre>
	<post>HasService(+DST_ADDR+, +ANY_PORT+)</post>
</hyperalert>
10 sept 2010 commit 2010-09-11 02:12:39 +02:00			`<?xml version="1.0" encoding="UTF-8"?>`
Supporting manual (un)correlations from web interface 2010-10-14 02:45:31 +02:00			`<!DOCTYPE hyperalert PUBLIC "-//blacklight//DTD HYPERALERT SNORT MODEL//EN" "http://0x00.ath.cx/hyperalert.dtd">`
10 sept 2010 commit 2010-09-11 02:12:39 +02:00
			`<hyperalert>`
			`<snort-id>122.1.0</snort-id>`
Correlation graphs, macro substitution improved 2010-09-14 19:24:03 +02:00			`<desc>(portscan) TCP Portscan</desc>`

10 sept 2010 commit 2010-09-11 02:12:39 +02:00			`<pre>HostExists(+DST_ADDR+)</pre>`
Correlation graphs, macro substitution improved 2010-09-14 19:24:03 +02:00			`<post>HasService(+DST_ADDR+, +ANY_PORT+)</post>`
10 sept 2010 commit 2010-09-11 02:12:39 +02:00			`</hyperalert>`