The reference keyword allows rules to include references to external attack identification systems. The plugin currently supports several specific systems as well as unique URLs. This plugin is to be used by output plugins to provide a link to additional information about the alert produced.
Make sure to also take a look at http://www.snort.org/pub-bin/sigs-search.cgi/ for a system that is indexing descriptions of alerts based on of the sid (See Section 3.4.4).
| System | URL Prefix |
| bugtraq | http://www.securityfocus.com/bid/ |
| cve | http://cve.mitre.org/cgi-bin/cvename.cgi?name= |
| nessus | http://cgi.nessus.org/plugins/dump.php3?id= |
| arachnids | (currently down) http://www.whitehats.com/info/IDS |
| mcafee | http://vil.nai.com/vil/content/v_ |
| osvdb | http://osvdb.org/show/osvdb/ |
| url | http:// |