[Oisf-users] classtype drop +oinkmaster

[mouna amani]

I used my rules on alert first and I got alerts with classtype Web
Application Attack and Misc activity and Attempted Information Leak

so I decided to make them all the rules with those  classtypes drop
using the following syntaxe in oinkmaster.conf :

modifysid * "^alert (.*classtype\s*:\s*Misc activity)" | "drop ${1}"
modifysid * "^alert (.*classtype\s*:\s*Web Application Attack)" | "drop ${1}"
modifysid * "^alert (.*classtype\s*:\s*Attempted Information Leak)" |
"drop ${1}"

but I did not get drop events in my fast.log
Any advice??