From a55960e6ba78d9ea2b9adbdb269e776d4759e958 Mon Sep 17 00:00:00 2001 From: Jason Ish Date: Fri, 1 Nov 2024 09:46:58 -0600 Subject: [PATCH] rules/modbus: remove rule for event that not longer exists The event "modbus.invalid_unit_identifier" no longer exists. Ticket: #7361 --- rules/modbus-events.rules | 2 -- 1 file changed, 2 deletions(-) diff --git a/rules/modbus-events.rules b/rules/modbus-events.rules index 27348e4a0b..afcc80a7e3 100644 --- a/rules/modbus-events.rules +++ b/rules/modbus-events.rules @@ -4,8 +4,6 @@ alert modbus any any -> any any (msg:"SURICATA Modbus invalid Protocol version"; alert modbus any any -> any any (msg:"SURICATA Modbus unsolicited response"; app-layer-event:modbus.unsolicited_response; classtype:protocol-command-decode; sid:2250002; rev:2;) # Malformed request or response. Malformed means length field is wrong alert modbus any any -> any any (msg:"SURICATA Modbus invalid Length"; app-layer-event:modbus.invalid_length; classtype:protocol-command-decode; sid:2250003; rev:2;) -# Unit identifier field is incorrect -alert modbus any any -> any any (msg:"SURICATA Modbus invalid Unit Identifier"; app-layer-event:modbus.invalid_unit_identifier; classtype:protocol-command-decode; sid:2250004; rev:2;) # Modbus Function code is incorrect alert modbus any any -> any any (msg:"SURICATA Modbus invalid Function code"; app-layer-event:modbus.invalid_function_code; classtype:protocol-command-decode; sid:2250005; rev:2;) # Modbus Request/Response value field is incorrect