[Snort-users] Rule is already commented

Brian (Automail) bmc at ...950...
Thu Jan 24 10:15:02 EST 2002


On Thu, Jan 24, 2002 at 11:57:37AM -0600, Ronneil Camara wrote:
> So, I kept finding the problem in my script. Until 4 hours of troubleshooting, I opened
> snortrules.tar.gz which I recently and opened web-iis.rules. I found out that there were
> already commented rules there. :-) Even the cvs copy of web-iis.rules was already commented.

By commented, I am guessing you mean commented out?

We have decided that deleting signatures is bad, so we are just disabling them.  
Not long off we will start moving deleted signatures to "deleted.rules" with 
some information included as to why the signature was disabled.  This allows us
to keep a historical record of signatures that sucked.

-b




More information about the Snort-users mailing list