5

I am analyzing Snort alert log and cannot figure what [1:1071:6] means in

10/12-12:44:28.793118  [**] [1:1071:6] WEB-MISC .htpasswd access [**] [Classification: Web Application Attack] [Priority: 1] {TCP}

Or let's say [1:100000160:2] in other case.

I couldn't find what that means neither in manuals nor in rules.

How can I figure out what format Snort log lines are in and what unknown fields represent?

2
  • Have you checked your output module's config file? You can define log output format any way you like by specifying output keywords separated by any arbitrary delimiter, there's no way for us to tell what exactly those numbers are. – TildalWave Jan 16 '14 at 20:21
  • May be stupid question, but how do those modules called, cannot find them. – user1880405 Jan 16 '14 at 20:36
8

Those numbers are a combination of unique identification and data source. Each Snort signature is identified by a SID (Signature ID) and a revision number. The SID is used to uniquely identify that specific signature and the revision is the edit number of that signature. So the original signature is rev:1;, then if it gets updated then incremented to rev:2; and so on.

There is also what's called a GID (Generator ID). Generators are different analysis routines within the snort process. Specifically each preprocessor has its own GID, the tagging system has a GID, and the rules engine has a GID. The rules engine is the processing subsystem that actually processes packets against the signatures found in all the various and sundry rules files.

Now, putting all that context to good use, the string [1:1071:6] tells us this alert was produced by GID 1 and triggered by SID 1071 revision 6. Since it has a GID of 1 we know that this can be found in the rules files. I usually run this command to view a specific rule:

grep 'sid:1071;' /etc/snort/rules/*.rules

Running that today it gives me the result:

/etc/snort/rules/VRT-server-webapp.rules:# alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"SERVER-WEBAPP .htpasswd access"; flow:to_server,established; content:".htpasswd"; fast_pattern:only; metadata:ruleset community, service http; classtype:web-application-attack; sid:1071; rev:13;)
2
  • Thank you very much Scott for explanation! Now on related note, if let's say there are two alerts: WEB-PHP remote include path (1:2002:5) and WEB-PHP remote include path {TCP} Are the the same, then why one says it's SID and nother TCP? – user1880405 Jan 16 '14 at 21:06
  • @user1880405: If the SIDs are different then they're different rules. Sometimes there are multiple ways of detecting specific behavior and it necessitates different rules. The {TCP} bit is probably being added in by whatever front-end you're viewing the alerts with. – Scott Pack Jan 16 '14 at 21:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.