[Snort-users] rules in snort inline

Crook, Parker Parker_Crook at ...14786...
Tue Jun 15 16:22:01 EDT 2010

I'm going to point you to use Nigel & Joel & JJ's advice on this one...

Furthermore if you want to change some rule from alert to drop, you should disable the rule (I also recommend Pulled Pork for downloading, enabling, disabling, etc) and move the rule to your local.rules file with your changes - make sure you give the rule a new sid number and update your sid-msg.map file.  That way, when you download the rule updates you don't overwrite your changes.



From: Burks, Doug [mailto:doug.burks at ...14446...]
Sent: Tuesday, June 15, 2010 3:46 PM
To: black_angel black_angel; snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] rules in snort inline

How about something like this?

sed -i 's|^alert |drop |g'  /etc/snort_inline/rules/*.rules





From: black_angel black_angel [mailto:black.sad.angel at ...11827...]
Sent: Tuesday, June 15, 2010 3:34 PM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] rules in snort inline

hey everybody,
i try to change all the rules for my snort inline from mode "alert" to "drop" i used this script but it doesn't work correctly:

cd /etc/snort_inline/rules/
for file in $(ls -1 *.rules)
               sed -e 's:^alert:drop:g' ${file} > ${file}.new
               mv ${file}.new ${file} -f

if someone have another script or any idea

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20100615/04e6cf8b/attachment.html>

More information about the Snort-users mailing list