[Snort-users] SnortCenter sensor "cloning"

larc larc at ...1187...
Fri Dec 6 08:18:02 EST 2002


Hi,

This is a problem with the current version, in the next version you will be able to put your enabled rules in templates. Then you just need to activate a one template.
I hope to finish it before the end of the year.

For now if you edit the file add_sensor.php and change in the sql queries sensor_name = 'default' to sensor_name = 'an existing sensor name'
Then when you add a new sensor it will clone the other sensor.

Cheers,
Stefan D.

------------------------
 scp at ...1284... wrote:
------------------------
-----BEGIN PGP SIGNED MESSAGE-----
>
>Hello all,
>
>What would be the best way to "clone" a sensor in SnortCenter? I have several "classes" (extranet, internet, internal.. etc) of sensors, but each one needs to be slightly different, so I do not what to group them. It seems like each time I deploy a sensor, I dread going through and disabling and enabling tons of rules. Having a generic "Default" sensor helps little, because of my different "classes" of sensors. Is there something I am missing? Is there a feature or better way of managing my sensors in SnortCenter?
>
>Thanks in advance,
>scp
>
>-----BEGIN PGP SIGNATURE-----
>Version: Hush 2.2 (Java)
>Note: This signature can be verified at https://www.hushtools.com/verify
>
>wlgEARECABgFAj3wseoRHHNjcEBodXNobWFpbC5jb20ACgkQiLP8kOqBWAhBGQCeOsai
>575vUiUP5yI0XUe8V79xofYAoKKC+rO8CXq7P9xkOOhxnaz8eZyu
>=DX0/
>-----END PGP SIGNATURE-----
>
>
>
>
>Concerned about your privacy? Follow this link to get
>FREE encrypted email: https://www.hushmail.com/?l=2 
>
>Big $$$ to be made with the HushMail Affiliate Program: 
>https://www.hushmail.com/about.php?subloc=affiliate&l=427
>
>
>-------------------------------------------------------
>This sf.net email is sponsored by:ThinkGeek
>Welcome to geek heaven.
>http://thinkgeek.com/sf
>_______________________________________________
>Snort-users mailing list
>Snort-users at lists.sourceforge.net
>Go to this URL to change user options or unsubscribe:
>https://lists.sourceforge.net/lists/listinfo/snort-users
>Snort-users list archive:
>http://www.geocrawler.com/redir-sf.php3?list=snort-users






More information about the Snort-users mailing list