[Snort-users] Alerting after Threshold/Suppression

["Justin Mitchell" <tcpandip@gmail.com>]

Hello All, 

I would like a rule to alert for a specified amount/time AFTER a threshold is met. Take the following rule for example:

alert tcp any any -> any $HTTP_PORTS (msg:"45\+ HTTP Requests \< 1 Minute"; flags:AP; pcre:!"/GET \/.*\.(gif|jpg|bmp|tiff|pic).*HTTP\/[0-9]\.[0-9]/i"; threshold: type both, track by_src, count 45, seconds 60; sid:5000001; rev:1;)

Accordingly, the rule only alerts (like it should) once every minute if more than 45 HTTP <non_image> requests are made within one minute. However, I would like for it (as long as it meets the specified flags and pcre) to fire thereafter for N seconds and/or N alerts. The catalyst for all this is I need to extract/roll-up the accompanying GET requests to verify fidelity and illustrate more context (w/o reviewing the log). 

Options tested/contemplated thus far (to my knowledge):

Activate/Dynamic rule  - Only valid for logging. If compatible with *alerting* I imagine I could construct an activate/pass -> dynamic/alert combo. 
Flowbits - Only valid for that session.
Suppression - Absolute suppression.
Tag - Nonessential packets are displayed.

Any ideas? Is Snort alone capable of this without manually correlating the solo alert to web logs? Telling Snort to run <insert_program_here> (pl,sh,py,etc) is another viable option but I could not locate concrete/stable information on how to accomplish this. 3rd party/home-grown preprocessor?

TIA!

- binaryechoes
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV

_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users