prelude-lml/master: Point alert message vendor description to the right url.
[email protected] Thu, 16 Jul 2009 11:38:22 +0200 (CEST)
| Newsgroups | gmane.comp.security.ids.prelude.cvs |
|---|---|
| Message-ID | <[email protected]> |
commit b263bd4c08fb41153eced5544c7d438c0bcd4b17
Author: Sebastien Tricaud <toady@kirk.(none)>
Date: Wed Jul 15 17:33:06 2009 +0200
Point alert message vendor description to the right url.
========================================
plugins/pcre/ruleset/cisco-common.rules | 10 +++++-----
plugins/pcre/ruleset/cisco-router.rules | 10 +++++-----
2 files changed, 10 insertions(+), 10 deletions(-)
========================================
diff --git a/plugins/pcre/ruleset/cisco-common.rules b/plugins/pcre/ruleset/cisco-common.rules
index a862d02..d5c9226 100644
--- a/plugins/pcre/ruleset/cisco-common.rules
+++ b/plugins/pcre/ruleset/cisco-common.rules
@@ -45,7 +45,7 @@ regex=%CDP-\d-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on (\S+) \(\
classification.reference(0).origin=vendor-specific; \
classification.reference(0).meaning=cisco_id; \
classification.reference(0).name=%CDP-4-NATIVE_VLAN_MISMATCH; \
- classification.reference(0).url=http://www.cisco.com/cgi-bin/Support/Errordecoder/index.cgi?action=search&paging=5&query=CDP-4-NATIVE_VLAN_MISMATCH; \
+ classification.reference(0).url=http://www.cisco.com/en/US/docs/ios/12_2/sem1/system/message/emfc6msf.html#wp946895; \
id=5500; \
revision=2; \
analyzer(0).name=Cisco IOS; \
@@ -68,7 +68,7 @@ regex=%CDP-\d-DUPLEX_MISMATCH: duplex mismatch discovered on (\S+) \([\w\s]+\),
classification.reference(0).origin=vendor-specific; \
classification.reference(0).meaning=cisco_id; \
classification.reference(0).name=%CDP-4-DUPLEX_MISMATCH; \
- classification.reference(0).url=http://www.cisco.com/cgi-bin/Support/Errordecoder/index.cgi?action=search&paging=5&query=CDP-4-DUPLEX_MISMATCH; \
+ classification.reference(0).url=http://www.cisco.com/en/US/docs/ios/12_2/sem1/system/message/emfc6msf.html#wp946885;\
id=5501; \
revision=2; \
analyzer(0).name=Cisco IOS; \
@@ -91,7 +91,7 @@ regex=%PORT_SECURITY-\d-SECURITYREJECT: Security violation occurred on module \d
classification.reference(0).origin=vendor-specific; \
classification.reference(0).meaning=cisco_id; \
classification.reference(0).name=%PORT_SECURITY-2-SECURITYREJECT; \
- classification.reference(0).url=http://www.cisco.com/cgi-bin/Support/Errordecoder/index.cgi?action=search&paging=5&query=PORT_SECURITY-2-SECURITYREJECT; \
+ classification.reference(0).url=https://www.cisco.com/en/US/docs/switches/lan/catalyst2900xl_3500xl/release12.0_5_wc6/scg/swmsg.html#wp1007036; \
id=5502; \
revision=2; \
analyzer(0).name=Cisco IOS; \
@@ -112,7 +112,7 @@ regex=%PORT_SECURITY-\d-PSECURE_VIOLATION: Security violation occurred, caused b
classification.reference(0).origin=vendor-specific; \
classification.reference(0).meaning=cisco_id; \
classification.reference(0).name=%PORT_SECURITY-2-PSECURE_VIOLATION; \
- classification.reference(0).url=http://www.cisco.com/cgi-bin/Support/Errordecoder/index.cgi?action=search&paging=5&query=PSECURE_VIOLATION; \
+ classification.reference(0).url=http://www.cisco.com/en/US/docs/switches/lan/catalyst2955/software/release/12_1_12c_ea1/system/message/msg_desc.html#wp1103356; \
id=5503; \
revision=2; \
analyzer(0).name=Cisco IOS; \
@@ -134,7 +134,7 @@ regex=%RTD-\d-ADDR_FLAP: (\S+) relearning (\d+) addrs per min; \
classification.reference(0).origin=vendor-specific; \
classification.reference(0).meaning=cisco_id; \
classification.reference(0).name=%RTD-1-ADDR_FLAP; \
- classification.reference(0).url=http://www.cisco.com/cgi-bin/Support/Errordecoder/index.cgi?action=search&paging=5&query=RTD-1-ADDR_FLAP; \
+ classification.reference(0).url=http://supportwiki.cisco.com/ViewWiki/index.php/What_does_the_RTD-1-ADDR_FLAP_system_message_mean%3F; \
id=5504; \
revision=2; \
analyzer(0).name=Cisco IOS; \
diff --git a/plugins/pcre/ruleset/cisco-router.rules b/plugins/pcre/ruleset/cisco-router.rules
index e879b0d..fd1f59c 100644
--- a/plugins/pcre/ruleset/cisco-router.rules
+++ b/plugins/pcre/ruleset/cisco-router.rules
@@ -31,7 +31,7 @@ regex=SEC-6-IPACCESSLOGP: list (\w+) denied (udp|tcp) ([\d\.]+)\((\d+)\).*-> ([\
classification.reference(0).origin=vendor-specific; \
classification.reference(0).meaning=cisco_id; \
classification.reference(0).name=%SEC-6-IPACCESSLOGP; \
- classification.reference(0).url=http://www.cisco.com/en/US/products/sw/iosswrel/ps1831/products_system_message_guide_chapter09186a00800f71b0.html; \
+ classification.reference(0).url=http://www.cisco.com/en/US/docs/ios/12_2/sem2/system/message/emfsdllc.html#wp971288; \
id=500; \
revision=2; \
analyzer(0).name=Router; \
@@ -63,7 +63,7 @@ regex=RCMD-4-RSHPORTATTEMPT:.* from ([\d\.]+); \
classification.reference(0).origin=vendor-specific; \
classification.reference(0).meaning=cisco_id; \
classification.reference(0).name=%RCMD-4-RSHPORTATTEMPT; \
- classification.reference(0).url=http://www.cisco.com/en/US/products/sw/iosswrel/ps1831/products_system_message_guide_chapter09186a00800f71b0.html; \
+ classification.reference(0).url=http://www.cisco.com/en/US/docs/ios/12_2/sem2/system/message/emfpquic.html#wp564542; \
id=501; \
revision=2; \
analyzer(0).name=Router; \
@@ -87,7 +87,7 @@ regex=%LINEPROTO-5-UPDOWN: Line protocol on Interface (\S+), changed state to (d
classification.reference(0).origin=vendor-specific; \
classification.reference(0).meaning=cisco_id; \
classification.reference(0).name=%LINEPROTO-5-UPDOWN; \
- classification.reference(0).url=http://www.cisco.com/en/US/products/sw/iosswrel/ps1831/products_system_message_guide_chapter09186a00800f71b0.html; \
+ classification.reference(0).url=http://www.cisco.com/en/US/docs/ios/11_0/system/message/etext.html#wp3717; \
id=502; \
revision=2; \
analyzer(0).name=Router; \
@@ -111,7 +111,7 @@ regex=%CRYPTO-6-IKMP_UNK_EXCHANGE: IKE peer at (\S+) * sent a message with unkno
classification.reference(0).origin=vendor-specific; \
classification.reference(0).meaning=cisco_id; \
classification.reference(0).name=%CRYPTO-6-IKMP_UNK_EXCHANGE; \
- classification.reference(0).url=http://www.cisco.com/en/US/products/sw/iosswrel/ps1831/products_system_message_guide_chapter09186a00800f71b0.html; \
+ classification.reference(0).url=http://www.cisco.com/en/US/docs/ios/12_3t/system/messages/smg2tmsd.html#wp823320; \
id=503; \
revision=2; \
analyzer(0).name=Router; \
@@ -140,7 +140,7 @@ regex=%IDS-4-(\S+)_SIG: Sig:(\d+):(.+) - from ([\d\.]+) to ([\d\.]+); \
classification.reference(0).origin=vendor-specific; \
classification.reference(0).meaning=cisco_id; \
classification.reference(0).name=%IDS-4-$1_SIG; \
- classification.reference(0).url=http://www.cisco.com/en/US/products/sw/iosswrel/ps1831/products_system_message_guide_chapter09186a00800f71b0.html; \
+ classification.reference(0).url=http://www.cisco.com/en/US/docs/ios/12_2/sem1/system/message/emfgsrip.html#wp934986; \
id=504; \
revision=1; \
analyzer(0).name=Router; \
_______________________________________________
Prelude-cvslog site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-cvslog