snort sfportscan log file output does not have event_id, instead is event_ref and the value is 0
0
1
my config is follow: preprocessor sfportscan: proto { all } scan_type { all } sense_level { high } logfile { alert } when I run snort,and use nmap to scan,then log file output as follow: Time: 02/23-12:54:21.183932 event_ref: 0 [Source ip address] -> [Destination ip address] (portscan) TCP Portscan Priority Count: 9 Connection Count: 10 IP Count: 1 Scanner IP Range: [Destination ip address]:[Destination ip address] Port/Proto Count: 10 Port/Proto Range: 981:12174 but the snort doc say as this: Time: 09/08-15:07:31.603880 event_id: 2 192.168.169.3 -> 192.168.169.5 (portscan) TCP Filtered Portscan Priority Count: 0 Connection Count: 200 IP Count: 2 Scanner IP Range: 192.168.169.3:192.168.169.4 Port/Proto Count: 200 Port/Proto Range: 20:47557 If there are open ports on the