On Mon, Oct 25, 2010 at 4:05 PM, Chow, Dennis <[email protected]> wrote: > Hello, > > > > I wrote a successful decoder and some rules that have matches and > descriptions. But I want to also be able to print out the srcip, srcport, > dstip, dstport, and extra_data information that was originally pulled from > the decoder and sent to my email. My current rule as follows: > > > > <rule id="100001" level="9"> > > <if_sid>100000</if_sid> > > <match>^somestring</match> > > <description>some description, can i pass variables from decoer to here? > $srcip or %%srcip?</description> > > <options>alert_by_email</options> > > </rule>
There's no way to currently do that. You can create an active response that pulls this information out and emails it to you separately.
