Snort mailing list archives

IDS Policy Manager trouble


From: Larry Wichman <larrywichman () yahoo com>
Date: Mon, 9 Jan 2006 07:17:17 -0800 (PST)

I have the latest version of IDS Policy Manager. It seems like evert once in a while, signatures that I have turned 
off, turn them selves back on. Itsounds weird, but it always seems to be the same signatures too. For instance, sig id 
2001848, I  turn it off, push the policy, restart Snort and I do not notice it for a couple of days. All of a sudden, 
this signature is triggering all kinds of FPs. If I open up the rule file for that sig, it is not commented out. I open 
the policy and it is unchecked and if I exit and save, it shows up as "updated". Now, I know some of you may be 
thinking that I have already have had a couple of beers this morning ;) but I have been messing around with this for a 
while and I know I have unchecked that signature, pushed the policy and restarted Snort, only to see that sig 
re-enabled with out my input. Please!! Someone tell me I am not the only one and someone else has seen this before. 

Current thread: