[Snort-users] Automatic Snort Ruleset Updates through Scripting

Nigel Houghton nhoughton at ...1935...
Mon Jun 28 07:24:56 EDT 2010


On Monday, June 28, 2010, Randal T. Rioux <randy at ...13561...> wrote:
> 0. Top posting releases demons into email threads. But my diatribe gets old.

Posting in the middle makes the baby Jesus cry

> 1. Who handles the Oinkcodes? BTW, I've never used Oinkmaster, which
> leads me to this question: What the hell is an Oinkcode?

You do, from your account on snort.org. You click something, and you
get one. It's a token that belongs to you, identifies you so you can
download stuff.

> 2. <blank stare, looks to left, switch to right>

The chicken is down.

> Randy
>
> PS Just noticed Watchinski is on my neighborhood board - Long Reach
> represent! (I thought that name looked familiar so I went through my
> stack of mail :-)

Taking over the world, one neighborhood at a time.

> On 06/27/2010 09:43 PM, JJ Cummings wrote:
>> 1. Oinkmaster is neither provided nor maintained by Sourcefire.
>>
>> 2. What if I want to use so rules?
>>
>> Sent from the iRoad
>>
>> On Jun 27, 2010, at 17:28, David Gullett <dgullett at ...13519...
>> <mailto:dgullett at ...13519...>> wrote:
>>
>>> For beginners to the world of Snort, we've published a new guide today
>>> that builds on our previous Snort setup documents. It describes a
>>> method to automatically update the Snort 2.8.6 rulesets using
>>> Oinkmaster and to also update the Ubuntu 10.04 LTS operating system
>>> using Aptitude - both through a bash script.
>>>
>>> And hey, you don't have to register to download. The information is
>>> available at this URL which provides a direct link to the article I've
>>> just described and the direct link to the most recent Snort setup
>>> guide:
>>> <http://www.symmetrixtech.com/articles/007-updatingsnortandubuntu.html>http://www.symmetrixtech.com/articles/007-updatingsnortandubuntu.html
>>>
>>> Feel free to comment on our poor bash scripting skills...
>
> ------------------------------------------------------------------------------
> This SF.net email is sponsored by Sprint
> What will you do first with EVO, the first 4G phone?
> Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>

-- 
Nigel Houghton
Head Mentalist
SF VRT
http://vrt-sourcefire.blogspot.com && http://labs.snort.org/




More information about the Snort-users mailing list