How to trigger IDS LOG

[gamluca]

I Receive the following ids log from Snort:

[2006.Jul.05 09:04:15]	- 	- 	Non classificato	07/05-09:04:19.598525 [**] [1:1852:3] WEB-MISC robots.txt access [**] [Classification: access to a potentially vulnerable web application] [Priority: 2] {TCP} 72.30.133.209:36364 -> 81.29.232.53:80
[2006.Jul.05 09:03:44]	- 	- 	Non classificato	07/05-09:03:32.401496 [**] [1:895:7] WEB-CGI redirect access [**] [Classification: Attempted Information Leak] [Priority: 2] {TCP} 81.29.232.55:1364 -> 81.29.232.53:80
[2006.Jul.05 08:57:11]	- 	- 	Non classificato	07/05-08:57:07.534785 [**] [1:1852:3] WEB-MISC robots.txt access [**] [Classification: access to a potentially vulnerable web application] [Priority: 2] {TCP} 68.142.250.31:48301 -> 81.29.232.53:80
[2006.Jul.05 08:51:08]	- 	- 	Non classificato	07/05-08:51:04.197855 [**] [1:2003:8] MS-SQL Worm propagation attempt [**] [Classification: Misc Attack] [Priority: 2] {UDP} 61.188.39.6:1032 -> 81.29.232.49:1434
[2006.Jul.05 08:51:08]	- 	- 	Non classificato	07/05-08:51:04.197855 [**] [1:2004:7] MS-SQL Worm propagation attempt OUTBOUND [**] [Classification: Misc Attack] [Priority: 2] {UDP} 61.188.39.6:1032 -> 81.29.232.49:1434
[2006.Jul.05 08:51:08]	- 	- 	Non classificato	07/05-08:51:04.197855 [**] [1:2050:8] MS-SQL version overflow attempt [**] [Classification: Misc activity] [Priority: 3] {UDP} 61.188.39.6:1032 -> 81.29.232.49:1434

I'd like to create a trigger when i receive Priority: 1 messages, but i can't use the .str parameter because doesn't accept spaces.

Anyone can help ?
Thanks.

[LEM]

To make the str() (and regexp() too) function to accept spaces, you should patch your config.inc.php as described hereafter: patch here.

Cheers,

[gamluca]

I did it, but this patch still don't support :

i need to check the string Priority: 1 and if i use the : the trigger can't be added.....
I even try to create a trigger with .str(1]) but even this don't work.

How to do ?

[LEM]

I did it, but this patch still don't support :

i need to check the string Priority: 1 and if i use the : the trigger can't be added.....
I even try to create a trigger with .str(1]) but even this don't work.

How to do ?

modify the eregi to accept ':' too in the parameter part, as I did for space.
consult the posix regexp for syntax if needed.

[gamluca]

if modify the eregi expression as follow and is working perfect.
Thanks.

if (eregi('^\{([0-9a-zA-Z\_\.-]+)\:([]\[0-9a-zA-Z\_\*\/\.\,\:\(\)-]+)\.([a-z]{3,11})\(([#0-9a-zA-Z\_\/\.\,[:space:]\:]+)\)\}$',$expression,$arr))