Issues with Reputation Inspector/Preprocessor

Hello Snort Community,

As the title says, I am having issues with this feature, what I want is to have alerts triggered when a blacklisted IP tries to communicate with my network.
What I want is somrthing like this: https://sublimerobots.com/2015/12/the-snort-reputation-preprocessor/

I am using Snort 3.1.69.0 and this is what I have done so far:
Configured Snort and rules to be used,
[cid:[email protected]]

Configured Reputation Inspector/Preprocessor,
[cid:[email protected]]

This the the alert I pasted for the blacklist alert:
[cid:[email protected]]

My test IP is in the blocklist:
[cid:[email protected]]

The rules are loaded, the reputation rule is classified as the builtin rule.
[cid:[email protected]]

Only these alerts appear
[cid:[email protected]]

And I would like something like “12/09-20:25:10.423907 [136:1:1] (spp_reputation) packets blacklisted [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 10.0.0.72:51312 -> 10.0.0.101:22”.


I have been at this for hours trying different things but nothing works, would appreciate it if anyone can give any insight.
Thank you

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette