Trigger alert from events from a specific connector?

Question

I have two Snort connectors setup in SEM. One that handles the WAN interface of our pfSense box and one that handles the LAN interface. I want to create a Rule that will trigger an alert when Snort detects a network scan on the LAN interface ONLY. How would I do this?

neomatrix1217 · Accepted Answer

Take a look at the events for the LAN and take note of the toolalias from there you can create a rule/alert using that field.

Trigger alert from events from a specific connector?

Top Replies