I'm using OpenAppID with Snort on pfSense, it actually work but when I view some script detector, it just detect by http pattern, which I can replace by using snort rule (with "content" option). So what is different between it?
closed as unclear what you're asking by Steffen Ullrich, Xander, Teun Vink, Jeroen - IT Nerdbox, Overmind Mar 26 at 13:22
Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.