How do I map the information in snort u2spewfoo output to the rule which triggered the alert?

Question

I have a snort log file in unified2 format and I am able to view the output using the u2spewfoo utility.

I think that I understand the generator id, signature id, and revision tell me why the alert was generated, but I'm not sure how to make sense out of them.

For instance, I have (sans packet data):

(Event)
sensor id: 0    event id: 3     event second: 1516750250        event microsecond: 585397
sig id: 527     gen id: 1       revision: 8      classification: 3
priority: 2     ip source: 0.0.0.0      ip destination: 255.255.255.255
src port: 68    dest port: 67   protocol: 17    impact_flag: 0  blocked: 0
mpls label: 0   vland id: 0     policy id: 0

I believe what I need is in the third line (sig id:). What does this tell me, and how do I map it to the rule which generated the event?

If it helps, I have a vanilla Debian installation with only the snort and snort-rules-default packages installed. The alert above was generated by processing a pcap file I had from a few months ago using the command:

snort -c /etc/snort/snort.conf -S HOME_NET=[192.168.1.0/24] -r daemonlogger.pcap.1516xxxxxx

This dumped several alerts to /var/log/snort/snort.log, which I then parsed with the u2spewfoo utility.

Answer 1

When gid is 1, it refers to the rules engine.

Snort maintains its rule files in the /etc/snort/rules directory (debian default). Each rule explicitly declares its sid (signature id).

Drawing from the example above, 'sid' is 527, so a simple grep returns the answer:

root@debian:~# cd /etc/snort/rules/
root@debian:/etc/snort/rules# grep 'sid:527' *.rules
bad-traffic.rules:alert ip any any -> any any (msg:"BAD-TRAFFIC same SRC/DST"; sameip; reference:bugtraq,2666; reference:cve,1999-0016; reference:url,www.cert.org/advisories/CA-1997-28.html; classtype:bad-unknown; sid:527; rev:8;)

This returns all of the required information.