oinkmaster - disabling rules without getting new updates

["Humes, David G." <David.Humes () jhuapl edu>]

I just setup oinkmaster to update our rules.  Let's say that a rule
suddenly starts generating thousands of false positive alerts, and we
want to disable the rule.  Normally I would add a disablesid line to the
conf file and run oinkmaster.  But, that's going to update my rules with
the latest rule set, which may or may not be what I want.  If it's late
on a Friday afternoon, I don't want to introduce new rules that may
false positive over the weekend.  The oinkmaster documentation is fairly
insistent about not editing the rules files directly.  But, one approach
is to edit the appropriate rules file and restart snort, and also edit
the oinkmaster.conf file to make certain the rule does not get
re-enabled.  Another possibility is to run oinkmaster using only local
copies of the rules archives so it doesn't update from the URLs.  But,
that introduces an extra step of having to manually download the
updates.  Yet another approach would be to run oinkmaster interactively,
and just reject all the changes with the exception of the one I added.
Ideally, I think that there should be an oinkmaster option for this to
minimize extra steps and to keep people from editing the rules files
directly.  Thoughts?

Thanks.

--Dave