Snort mailing list archives
Re: snortcenter rule update questio
From: "larc" <larc () pandora be>
Date: Thu 21 Nov 2002 11:08:59 +0100
Hi, You have to activate the rules for each sensor itself then when you update the rules, the current activated rules are still active. Normaly you have to use the default sensor scope only if you want to change rule options like 'content' or 'flow'. To activate rules you don't have to use the default sensor scope. I know that it can be confusing. In the next version the default sensor scope will no longer exist and then you can create rule templates where you can activate or deactivate rules, and then use these templates for the different sensor scope. Regards, Stefan D. ------------------------ AppleAnnie331 () aol com wrote: ------------------------ When you install a sensor - it get's it's config & rules from
the Default Sensor. When you import/update the rules, they get migrated to the Default Sensor as well right? How does one then push the new config to the sensors? When I updated mine, the senors now have no rules acivated? It's a lenghty process to go back and set them up like I have the default setup. I must be missing something. Can you help? Thanks ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Re: snortcenter rule update questio larc (Nov 21)