[Snort-users] rules in snort inline

Crook, Parker Parker_Crook at ...14786...
Tue Jun 15 16:22:01 EDT 2010


I'm going to point you to use Nigel & Joel & JJ's advice on this one...



Furthermore if you want to change some rule from alert to drop, you should disable the rule (I also recommend Pulled Pork for downloading, enabling, disabling, etc) and move the rule to your local.rules file with your changes - make sure you give the rule a new sid number and update your sid-msg.map file.  That way, when you download the rule updates you don't overwrite your changes.



-Parker



  _____

From: Burks, Doug [mailto:doug.burks at ...14446...]
Sent: Tuesday, June 15, 2010 3:46 PM
To: black_angel black_angel; snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] rules in snort inline



How about something like this?



sed -i 's|^alert |drop |g'  /etc/snort_inline/rules/*.rules



Regards,

--

Doug Burks, GPEN, GCIA, GSEC, CISSP
http://securityonion.blogspot.com





  _____

From: black_angel black_angel [mailto:black.sad.angel at ...11827...]
Sent: Tuesday, June 15, 2010 3:34 PM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] rules in snort inline

hey everybody,
i try to change all the rules for my snort inline from mode "alert" to "drop" i used this script but it doesn't work correctly:



cd /etc/snort_inline/rules/
for file in $(ls -1 *.rules)
do
               sed -e 's:^alert:drop:g' ${file} > ${file}.new
               mv ${file}.new ${file} -f

done
if someone have another script or any idea

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20100615/04e6cf8b/attachment.html>


More information about the Snort-users mailing list