[Snort-users] modifying priority on certain rules

Andreas Östling andreaso at ...236...
Tue Feb 21 14:31:05 EST 2006


On Tue, 21 Feb 2006, Christina McAghon wrote:

> I am running snort v2.3.3.  I would like to change the priority of a few
> certain rules (without affecting the default classification.config
> priority).  I thought I could achieve this by copying the rule from its
> rule file into local.rules.  In local.rules, I added the priority
> classification.  Here's an example:

I think that's generally a bad way to customize rules unless you're 
careful. Moving a rule into local.rules usually means it will be 
forgotten and stay there untouched forever, i.e. if the official 
version of it gets updated, you would still have the old one.

Now some shameless plugs...
I would use the "modifysid" function in Oinkmaster 
(http://oinkmaster.sf.net/) to customize the rules instead. This way you 
can continue to use the latest and greatest rules automatically while 
still being able to tweak them, like changing the priority.
I tried to document these things in the Oinkmaster FAQ (Q21).

By the way, if you really ment Snort 2.3.3, you should upgrade to 
2.4.3 ASAP. See the warning at http://www.snort.org/dl/old/ if you 
don't believe me.

/Andreas




More information about the Snort-users mailing list