[Oisf-users] Suricata 1.4 simple alert rule, first visit to website not triggering an alert

[Eoin Miller]

On 1/10/2013 20:34, Eoin Miller wrote:
> On 1/10/2013 19:57, Vincent Fang wrote:
>>
>> alert http any any -> 207.86.164.0/24 <http://207.86.164.0/24> any (msg:
>> "visiting businessweek")
> 
> Maybe try alert tcp instead of alert http.
> 
> -- Eoin

alert ip might even be better.

-- Eoin