Snort classification.config文件概述

0x00来源

解压自snortrules-snapshot-2975.tar.gz，来自于<解压目录>/etc/
　　　classification.config
　　　reference.config
　　　sid-msg.map
　　　snort.conf
　　　threshold.conf
　　　unicode.map
将这些.conf和.map文件放在/etc/snort 目录下，具体的请看 CentOS6.6下基于snort+barnyard2+base的入侵检测系统的搭建

0x01文件头翻译

# $Id: classification.config,v 1.14 2011/06/08 00:33:04 jjordan Exp $
# The following includes information for prioritizing rules
# 下面的内容包括了“优先”规则的信息
# 
# Each classification includes a shortname, a description, and a default 
# priority for that classification.
# 每个类别都有简称，描述，默认优先级。
# This allows alerts to be classified and prioritized.  You can specify
# what priority each classification has.  Any rule can override the default
# priority for that rule.
# 这种方式使得告警可以被分类和优先选择。你可以指定每个分类的优先级。任何规则都可以重写这些
# 默认的优先级。
# Here are a few example rules:
# 
#   alert TCP any any -> any 80 (msg: "EXPLOIT ntpdx overflow"; 
#       dsize: > 128; classtype:attempted-admin; priority:10;
#
#   alert TCP any any -> any 25 (msg:"SMTP expn root"; flags:A+; \
#             content:"expn root"; nocase; classtype:attempted-recon;)
#
# The first rule will set its type to "attempted-admin" and override 
# the default priority for that type to 10.
# 第一个规则被分在"attempted-admin"类，并且重写了默认优先级。
# The second rule set its type to "attempted-recon" and set its
# priority to the default for that type.
# 第二个规则被分在"attempted-recon"类，采用了此类别默认的优先级。
#
# config classification:shortname,short description,priority
# 用以上格式书写

0x02 修饰符

此文件对应的修饰符是classtype。查看manual可知，此关键字的作用为了将告警分类。
举个例子。

alert tcp any any -> any 25 (msg:"SMTP expn root"; flags:A+; content:"expn root"; nocase; classtype:attempted-recon;)

classtype必须在classification.config文件中才可以使用，如果想自定义，可以自行修改clssfication.config文件。

0x03 数据库

classtype对应着数据库中的sig_class表，全称写出来更好理解一点，signature_classification。
　　通过这里我们了解到snort数据库的ER图，sig这部分的如下：

sig三张表

mysql> desc sig_class
    -> ;
+----------------+------------------+------+-----+---------+----------------+
| Field          | Type             | Null | Key | Default | Extra          |
+----------------+------------------+------+-----+---------+----------------+
| sig_class_id   | int(10) unsigned | NO   | PRI | NULL    | auto_increment |
| sig_class_name | varchar(60)      | NO   | MUL | NULL    |                |
+----------------+------------------+------+-----+---------+----------------+
2 rows in set (0.07 sec)
mysql> select * from sig_class;
+--------------+-----------------+
| sig_class_id | sig_class_name  |
+--------------+-----------------+
|            1 | attempted-admin |
|            2 | misc-attack     |
+--------------+-----------------+
2 rows in set (0.00 sec)

sig_class表中就两列，sig_class_id是分类的ID（应该是递增的），sig_class_name是分类的名称。

mysql> desc signature;
+--------------+------------------+------+-----+---------+----------------+
| Field        | Type             | Null | Key | Default | Extra          |
+--------------+------------------+------+-----+---------+----------------+
| sig_id       | int(10) unsigned | NO   | PRI | NULL    | auto_increment |
| sig_name     | varchar(255)     | NO   | MUL | NULL    |                |
| sig_class_id | int(10) unsigned | NO   | MUL | NULL    |                |
| sig_priority | int(10) unsigned | YES  |     | NULL    |                |
| sig_rev      | int(10) unsigned | YES  |     | NULL    |                |
| sig_sid      | int(10) unsigned | YES  |     | NULL    |                |
| sig_gid      | int(10) unsigned | YES  |     | NULL    |                |
+--------------+------------------+------+-----+---------+----------------+
7 rows in set (0.04 sec)

mysql> select * from signature;
+--------+--------------------------------+--------------+--------------+---------+---------+---------+
| sig_id | sig_name                       | sig_class_id | sig_priority | sig_rev | sig_sid | sig_gid |
+--------+--------------------------------+--------------+--------------+---------+---------+---------+
|      8 | Snort Alert [1:1000011:0]      |            0 |         NULL |       1 | 1000011 |       1 |
|      9 | PROTOCOL-ICMP PACKAGE DETECTED |            0 |         NULL |       1 | 1000011 |       1 |
+--------+--------------------------------+--------------+--------------+---------+---------+---------+
2 rows in set (0.00 sec)

从上面我们可以看到两张表中，sig_class的主键是sig_class_id，signature表的主键是sig_id，外键是sig_class_id。