[Snort-sigs] White and Blacklist Rules

Eichhorn Sophia sophia.eichhorn at tu-braunschweig.de
Fri Jun 15 13:00:02 EDT 2018

Hey everybody,

I'm very new in Snort and have a question regarding the white and 
black rules. I know the different between
white and blacklists but I would like to know how I can define the 
rules. Special the whitelist rules.
My problem is, that I know how to create a blacklist rule but I need 
to define a whitelist.

Is that possible or can I only "whitelist" IP-Addresses? Do You have 
an example or an idea?

Please help me and tanks for everything!


More information about the Snort-sigs mailing list