Snort mailing list archives
IDS Policy Manager trouble
From: Larry Wichman <larrywichman () yahoo com>
Date: Mon, 9 Jan 2006 07:17:17 -0800 (PST)
I have the latest version of IDS Policy Manager. It seems like evert once in a while, signatures that I have turned off, turn them selves back on. Itsounds weird, but it always seems to be the same signatures too. For instance, sig id 2001848, I turn it off, push the policy, restart Snort and I do not notice it for a couple of days. All of a sudden, this signature is triggering all kinds of FPs. If I open up the rule file for that sig, it is not commented out. I open the policy and it is unchecked and if I exit and save, it shows up as "updated". Now, I know some of you may be thinking that I have already have had a couple of beers this morning ;) but I have been messing around with this for a while and I know I have unchecked that signature, pushed the policy and restarted Snort, only to see that sig re-enabled with out my input. Please!! Someone tell me I am not the only one and someone else has seen this before.
Current thread:
- IDS Policy Manager trouble Larry Wichman (Jan 09)
- RE: IDS Policy Manager trouble Jeff Dell (Jan 09)