Wrong lookup in Splunk for Sourcefire

[sha1020]

Hi,

some events are displayed with the wrong message in the Splunk for Sourcefire app Event Dashboard:

Events with "sid=4 gen=119" (which is "HI_CLIENT_BARE_BYTE") are displayed as "SSH_EVENT_PROTOMISMATCH" (which has "sid=4 gen=128").

It seems that the lookup for preprocessor rules is defined incorrectly. Other rules are displayed correctly.

Best regards,
Stephan

[gdrapp]

There's a bug in the Top 10 Alerts and Last 10 Intrusion Events sections of the dashboard. The searches for these two sections perform a "join sid [search rule_records]" when they should really be performing a "join sid,gen [search rule_records]". SID alone does not uniquely identify a rule, you have to use the SID and the generator (gen).