[Snort-users] Activeworx IDS Policy Manager
tslighter at ...5174...
Fri Jul 26 09:09:03 EDT 2002
I have experienced the same issues and also would like to add one more to
the list. Sometimes, when closing the IDS policy manager, once it has been
re-opened, the managed sensor is no longer there and I have to re-add
everything. This happens on one IDS policy manager but not on another and
they are both the same version. As for your particular issue, I believe I
have found a workaround. For any rules/alerts that I wish to modify or add.
I have created a completely new and separate group that is not normally
included in the snortrule.tar.gz...such as "experimental2.rules". I place
all ot my customized and edited rules into this group and therefore whenever
I update the rules or update from the web, all of the rules in that group
stay the same and never get modified by any updates.
From: Shifflett, Shawn [mailto:SShifflett at ...6449...]
Sent: Thursday, July 25, 2002 1:17 PM
To: 'snort-users at lists.sourceforge.net'
Subject: RE: [Snort-users] Activeworx IDS Policy Manager
I am currently using it in my environment. So far I have had
excellent success in using it to manage several sensors with multiple NICs
per sensor. Very easy to use. The only semi-complaint that I have had with
the product is that once you use IDS Policy Manager to make any changes to
your 'snort.conf' file it strips all of the comments from the conf file
itself. Not a big deal for me personally as I'm used to modifying
'snort.conf' locally from the command line, but if I were to introduce
someone else to the conf file for local administration it would be a minor
headache to have to constantly reference the Snort documentation instead of
just reading the comments.
All in all, however, I am pleased with the software.
From: spyguy [mailto:spyguy703 at ...741...]
Sent: Thursday, July 25, 2002 2:34 PM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] Activeworx IDS Policy Manager
Does anyone here use Activeworx IDS Policy Manager?
If yes, how do you like it?
ATTENTION: This email may contain privileged and confidential information
intended only for the use of the individual(s) named above. If you are not
the intended recipient, please delete this email and any attachments and
notify the sender immediately. Thank you.
This sf.net email is sponsored by: Jabber - The world's fastest growing
real-time communications platform! Don't just IM. Build it in!
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:
More information about the Snort-users