[Snort-users] Writing/placing custom rules
joel.esler at ...1935...
Thu Feb 9 08:11:14 EST 2006
My recommendation is to place your custom rules in the local.rules
file. If you are going to use alot of pass rules, I generally
recommend making a whole different rules file called pass.rules, then
place your pass rules in that file. Just make sure you include the
pass.rules in your snort.conf file.
However, rather than writing alot of pass rules, I generally
recommend using suppression instead of pass rules.
Check out the Snort User manual for details on suppression.
On Feb 9, 2006, at 11:06 AM, mac subbu wrote:
> We would like to add custom rules to our snort configuration file
> 11)which would be the best place to write them
> a)Write pass alert rules directly in the snort conf file
> b)In local rules file
> IF i write them in local rules file what would it impact on other
> rule files
> What precautions need to be taken and what are the best practices
More information about the Snort-users