Snort alert log simple question

Question

I am analyzing Snort alert log and cannot figure what [1:1071:6] means in

10/12-12:44:28.793118  [**] [1:1071:6] WEB-MISC .htpasswd access [**] [Classification: Web Application Attack] [Priority: 1] {TCP}

Or let's say [1:100000160:2] in other case.

I couldn't find what that means neither in manuals nor in rules.

How can I figure out what format Snort log lines are in and what unknown fields represent?

Answer 1

Those numbers are a combination of unique identification and data source. Each Snort signature is identified by a SID (Signature ID) and a revision number. The SID is used to uniquely identify that specific signature and the revision is the edit number of that signature. So the original signature is rev:1;, then if it gets updated then incremented to rev:2; and so on.

There is also what's called a GID (Generator ID). Generators are different analysis routines within the snort process. Specifically each preprocessor has its own GID, the tagging system has a GID, and the rules engine has a GID. The rules engine is the processing subsystem that actually processes packets against the signatures found in all the various and sundry rules files.

Now, putting all that context to good use, the string [1:1071:6] tells us this alert was produced by GID 1 and triggered by SID 1071 revision 6. Since it has a GID of 1 we know that this can be found in the rules files. I usually run this command to view a specific rule:

grep 'sid:1071;' /etc/snort/rules/*.rules

Running that today it gives me the result:

/etc/snort/rules/VRT-server-webapp.rules:# alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"SERVER-WEBAPP .htpasswd access"; flow:to_server,established; content:".htpasswd"; fast_pattern:only; metadata:ruleset community, service http; classtype:web-application-attack; sid:1071; rev:13;)