[Snort-users] SnortCenter sensor "cloning"

larc larc at ...1187...
Fri Dec 6 08:18:02 EST 2002


This is a problem with the current version, in the next version you will be able to put your enabled rules in templates. Then you just need to activate a one template.
I hope to finish it before the end of the year.

For now if you edit the file add_sensor.php and change in the sql queries sensor_name = 'default' to sensor_name = 'an existing sensor name'
Then when you add a new sensor it will clone the other sensor.

Stefan D.

 scp at ...1284... wrote:
>Hello all,
>What would be the best way to "clone" a sensor in SnortCenter? I have several "classes" (extranet, internet, internal.. etc) of sensors, but each one needs to be slightly different, so I do not what to group them. It seems like each time I deploy a sensor, I dread going through and disabling and enabling tons of rules. Having a generic "Default" sensor helps little, because of my different "classes" of sensors. Is there something I am missing? Is there a feature or better way of managing my sensors in SnortCenter?
>Thanks in advance,
>Version: Hush 2.2 (Java)
>Note: This signature can be verified at https://www.hushtools.com/verify
>Concerned about your privacy? Follow this link to get
>FREE encrypted email: https://www.hushmail.com/?l=2 
>Big $$$ to be made with the HushMail Affiliate Program: 
>This sf.net email is sponsored by:ThinkGeek
>Welcome to geek heaven.
>Snort-users mailing list
>Snort-users at lists.sourceforge.net
>Go to this URL to change user options or unsubscribe:
>Snort-users list archive:

More information about the Snort-users mailing list