0x00來源
解壓自snortrules-snapshot-2975.tar.gz蔫敲，來自于<解壓目錄>/etc/
classification.config
reference.config
sid-msg.map
snort.conf
threshold.conf
unicode.map
將這些.conf和.map文件放在/etc/snort 目錄下扮碧，具體的請看 CentOS6.6下基于snort+barnyard2+base的入侵檢測系統(tǒng)的搭建
0x01文件頭翻譯
# $Id: classification.config,v 1.14 2011/06/08 00:33:04 jjordan Exp $
# The following includes information for prioritizing rules
# 下面的內(nèi)容包括了“優(yōu)先”規(guī)則的信息
#
# Each classification includes a shortname, a description, and a default
# priority for that classification.
# 每個類別都有簡稱，描述陡舅，默認(rèn)優(yōu)先級。
# This allows alerts to be classified and prioritized. You can specify
# what priority each classification has. Any rule can override the default
# priority for that rule.
# 這種方式使得告警可以被分類和優(yōu)先選擇。你可以指定每個分類的優(yōu)先級挂脑。任何規(guī)則都可以重寫這些
# 默認(rèn)的優(yōu)先級踊餐。
# Here are a few example rules:
#
# alert TCP any any -> any 80 (msg: "EXPLOIT ntpdx overflow";
# dsize: > 128; classtype:attempted-admin; priority:10;
#
# alert TCP any any -> any 25 (msg:"SMTP expn root"; flags:A+; \
# content:"expn root"; nocase; classtype:attempted-recon;)
#
# The first rule will set its type to "attempted-admin" and override
# the default priority for that type to 10.
# 第一個規(guī)則被分在"attempted-admin"類景醇，并且重寫了默認(rèn)優(yōu)先級。
# The second rule set its type to "attempted-recon" and set its
# priority to the default for that type.
# 第二個規(guī)則被分在"attempted-recon"類吝岭，采用了此類別默認(rèn)的優(yōu)先級三痰。
#
# config classification:shortname,short description,priority
# 用以上格式書寫
0x02 修飾符
此文件對應(yīng)的修飾符是classtype。查看manual可知窜管，此關(guān)鍵字的作用為了將告警分類散劫。
舉個例子。
alert tcp any any -> any 25 (msg:"SMTP expn root"; flags:A+; content:"expn root"; nocase; classtype:attempted-recon;)
classtype必須在classification.config文件中才可以使用幕帆，如果想自定義获搏，可以自行修改clssfication.config文件。
0x03 數(shù)據(jù)庫
classtype對應(yīng)著數(shù)據(jù)庫中的sig_class表蜓肆，全稱寫出來更好理解一點(diǎn)颜凯，signature_classification谋币。
通過這里我們了解到snort數(shù)據(jù)庫的ER圖，sig這部分的如下：
sig三張表
mysql> desc sig_class
-> ;
+----------------+------------------+------+-----+---------+----------------+
| Field | Type | Null | Key | Default | Extra |
+----------------+------------------+------+-----+---------+----------------+
| sig_class_id | int(10) unsigned | NO | PRI | NULL | auto_increment |
| sig_class_name | varchar(60) | NO | MUL | NULL | |
+----------------+------------------+------+-----+---------+----------------+
2 rows in set (0.07 sec)
mysql> select * from sig_class;
+--------------+-----------------+
| sig_class_id | sig_class_name |
+--------------+-----------------+
| 1 | attempted-admin |
| 2 | misc-attack |
+--------------+-----------------+
2 rows in set (0.00 sec)
sig_class表中就兩列症概，sig_class_id是分類的ID（應(yīng)該是遞增的）蕾额，sig_class_name是分類的名稱。
mysql> desc signature;
+--------------+------------------+------+-----+---------+----------------+
| Field | Type | Null | Key | Default | Extra |
+--------------+------------------+------+-----+---------+----------------+
| sig_id | int(10) unsigned | NO | PRI | NULL | auto_increment |
| sig_name | varchar(255) | NO | MUL | NULL | |
| sig_class_id | int(10) unsigned | NO | MUL | NULL | |
| sig_priority | int(10) unsigned | YES | | NULL | |
| sig_rev | int(10) unsigned | YES | | NULL | |
| sig_sid | int(10) unsigned | YES | | NULL | |
| sig_gid | int(10) unsigned | YES | | NULL | |
+--------------+------------------+------+-----+---------+----------------+
7 rows in set (0.04 sec)
mysql> select * from signature;
+--------+--------------------------------+--------------+--------------+---------+---------+---------+
| sig_id | sig_name | sig_class_id | sig_priority | sig_rev | sig_sid | sig_gid |
+--------+--------------------------------+--------------+--------------+---------+---------+---------+
| 8 | Snort Alert [1:1000011:0] | 0 | NULL | 1 | 1000011 | 1 |
| 9 | PROTOCOL-ICMP PACKAGE DETECTED | 0 | NULL | 1 | 1000011 | 1 |
+--------+--------------------------------+--------------+--------------+---------+---------+---------+
2 rows in set (0.00 sec)
從上面我們可以看到兩張表中彼城，sig_class的主鍵是sig_class_id诅蝶，signature表的主鍵是sig_id，外鍵是sig_class_id募壕。
