cpw at ...440...
Tue Nov 13 12:09:13 EST 2001
On Tue, Nov 13, 2001 at 09:54:31AM -0800, Joe Smith wrote:
> To the administrators of SNORT,
> An excerpt from "classification.config" from the most
> recent snort rules download.
One thing that has not been over stated since the inception of
the "classification.config" file is the following:
As a snort administrator/installer you should edit classification.config
to suit the policies of your organization. At the same time, you should
review the rules which you are including in your snort.conf file for
appropriateness, and to verify their classification in relation to the
changes you made to the classification.config file. You should not use
either the classification.config or rules out of the box. To do so,
is a dereliction of duty.
Phil Wood, cpw at ...440...
More information about the Snort-users