Snort mailing list archives
Re: How to decide which rules should be enabled.
From: "Lay, James" <james.lay () wincofoods com>
Date: Thu, 19 Jul 2012 10:02:16 -0600
From: Joel Esler [mailto:jesler () sourcefire com] Sent: Thursday, July 19, 2012 9:54 AM To: Bravo Snipper Cc: snort list Subject: Re: [Snort-users] How to decide which rules should be enabled. The answer is "it depends" You can make pulled pork still output the "individual" files if you want. I don't know the command for it, but maybe JJ can chime in here? On Thu, Jul 19, 2012 at 4:03 AM, Bravo Snipper <snipperbravo () yahoo com> wrote: Hi Al right I opted for rule policy "security" in pulledpork. Now when i manually downloaded snortrules-snapshot-xxxx I can see different *.rules file, a separate pre_proc directory etc. But when i use pulledpork it only places a singal file snort.rules in rules directory, it has all the rules in single file. Why is it different? Isn't keeping separate rules file e.g scan.rules, web-attack.rules is more manageable. Can this(keeping single rule file or multiple) be configured using pulledpork configuration. Currently I used pulledpork in the following way; -My pulledpork command /usr/local/bin/pulledpork.pl -c /etc/snort/pulledpork.conf -T -l -ips_policy=security Regards Chiming in, though I'm not JJ :D -k will get what you need...caveat is that the rules files will be have VRT- and ET- prepended to each file, so you'll need to adjust your snort.conf to reflect it. Least that's my experience. James ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- How to decide which rules should be enabled. Bravo Snipper (Jul 18)
- Re: How to decide which rules should be enabled. Jeremy Hoel (Jul 18)
- Re: How to decide which rules should be enabled. Tony Robinson (Jul 18)
- Re: How to decide which rules should be enabled. Tony Robinson (Jul 18)
- Re: How to decide which rules should be enabled. Bravo Snipper (Jul 19)
- Re: How to decide which rules should be enabled. Lay, James (Jul 19)
- Re: How to decide which rules should be enabled. Joel Esler (Jul 19)
- Re: How to decide which rules should be enabled. Lay, James (Jul 19)
- Re: How to decide which rules should be enabled. Castle, Shane (Jul 19)
- Re: How to decide which rules should be enabled. JJC (Jul 19)
- Re: How to decide which rules should be enabled. Joel Esler (Jul 19)
- Re: How to decide which rules should be enabled. Tony Robinson (Jul 18)