Log into the sensors box

sudo vi /etc/snort/rules/community.rules

Add the following rule:

alert tcp any any -> any any (msg:"Sample Metron Message from Snort"; sid:999158; )

sudo service snortd restart


  • No labels