New answers tagged snort
One idea (though it may or may not be correct) is that malware on your system could be trying to reach out to its creator (e.g. to send out information or to allow for your system to be used in a botnet). The * is typically used as a "wild card". For example, the domain www.abc.3d-game.com should be found by the *.3d-game.com query. The domains shown here ...
It is a preprocessor to Snort and can't be used in anything but Snort unless you, essentially rewrite Snort's decoder and preprocessor structure. But why would you do that when you can just use Snort?
I don't have much experience with AWS, but if your main goal is to protect against web-related exploits like XSS, SQL injection, etc., then a web application firewall may be more effective. Snort certainly has rules available for these things, but in my experience a web application firewall will do a better job. This thread has a good explanation on why this ...
Top 50 recent answers are included