Snort mailing list archives
Reputation blacklists and snort_control
From: Stanford Prescott <stan.prescott () gmail com>
Date: Thu, 16 Mar 2017 07:24:16 -0500
From some researching I have been doing about the reputation preprocessor,
I have read that reputation IP blacklists need to have alerts (gids sids) created for the IPs. But when I have downloaded the Talos IP lists and loaded them via the snort control socket using pulledpork I can't see that any alerts rules for the IPs have been created. I am using snort 2.9.9.0 with the appropriate config options for the reputation preprocessor and snort_control and library .so dependencies with successful loading messages from snort in the log files. Using the loading of the IP lists via snort_control, are alerts rules created anywhere for the IP lists? ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Reputation blacklists and snort_control Stanford Prescott (Mar 16)
- Re: Reputation blacklists and snort_control Joel Esler (jesler) (Mar 16)
- Re: Reputation blacklists and snort_control Stanford Prescott (Mar 16)
- Re: Reputation blacklists and snort_control Joel Esler (jesler) (Mar 16)