Thanks, validation would be nice. I also tested in my environment and found following the wiki instruction, just replace Perimeter and Network Monitoring with Network Monitoring and the product package works (somewhat! See below.)
However, I did notice that the Snort package has a very limited set of filters and reviewing the Snort Manual, there are serveral additional classtype:classifications that could be
added to the Snort package. While reviewing the Raw Log, I also noticed that the Description, not the classtype is sent by syslog. This will break the existing filters provided in the Snort product package.
i.e.: /All Filters/ArcSight Activate/Core/Product Filters/Snort NIDS/IDS Suspicious Events/Denial of Service Events
* the Device Event Category = successful-dos, however, the Raw Log will say, <###> BLAH..... [Classification: Denial of Service] BLAH....
I've not seen this live with a DoS Snort alert and I'm making some assumptions based on other raw logs I'm evaluating, specifically trojan-activity. Raw log only mentions [Classification: A Network Trojan was detected]
Pretty much all the filters need to change to the Description, not the classtype. In addition, for the high/very high device severity filters. The priority could be used instead of specific classtypes if you wanted too.
All in all, if you have some cycles and can verify this, I think would greatly improve the usability of the Snort product package. I also noticed in the Sourcefire product package that you did the same thing as snort product package (using classtype instead of description), however as you mention in the Sourcefire product package documentation, it is for CEF sourcefire product only (not the generic Snort syslog) so this may work for Sourcefire (I can't verify this one...).
.
