Snort mailing list archives
Re: oinkmaster - disabling rules without getting new updates
From: "Alex Butcher, ISC/ISYS" <Alex.Butcher () bristol ac uk>
Date: Tue, 20 Sep 2005 11:05:00 +0100
--On 19 September 2005 17:12 -0400 "Humes, David G." <David.Humes () jhuapl edu> wrote:
I just setup oinkmaster to update our rules. Let's say that a rule suddenly starts generating thousands of false positive alerts, and we want to disable the rule. Normally I would add a disablesid line to the conf file and run oinkmaster. But, that's going to update my rules with the latest rule set, which may or may not be what I want. If it's late on a Friday afternoon, I don't want to introduce new rules that may false positive over the weekend. The oinkmaster documentation is fairly insistent about not editing the rules files directly. But, one approach is to edit the appropriate rules file and restart snort, and also edit the oinkmaster.conf file to make certain the rule does not get re-enabled. Another possibility is to run oinkmaster using only local copies of the rules archives so it doesn't update from the URLs. But, that introduces an extra step of having to manually download the updates.
Why not write a couple of scripts to wrap oinkmaster; one that uses wget to grab the updates to local files first before runs oinkmaster, and another that uses pre-existing local files?
I've already done the former, and I'm tempted to comment out a couple of lines to create the latter to handle the very scenario you've described.
--Dave
Best Regards, Alex. -- Alex Butcher: Security & Integrity, Personal Computer Systems Group Information Systems and Computing GPG Key ID: F9B27DC9 GPG Fingerprint: D62A DD83 A0B8 D174 49C4 2849 832D 6C72 F9B2 7DC9 ------------------------------------------------------- SF.Net email is sponsored by: Tame your development challenges with Apache's Geronimo App Server. Download it for free - -and be entered to win a 42" plasma tv or your very own Sony(tm)PSP. Click here to play: http://sourceforge.net/geronimo.php _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- oinkmaster - disabling rules without getting new updates Humes, David G. (Sep 19)
- Re: oinkmaster - disabling rules without getting new updates Joel Esler (Sep 19)
- Re: oinkmaster - disabling rules without getting new updates Andreas Östling (Sep 20)
- Re: oinkmaster - disabling rules without getting new updates Alex Butcher, ISC/ISYS (Sep 20)
- <Possible follow-ups>
- RE: oinkmaster - disabling rules without getting new updates Humes, David G. (Sep 19)