[Snort-users] Pulledpork and proprocessor rules

Lay, James james.lay at ...15009...
Fri Jan 24 09:58:48 EST 2014



-----Original Message-----
From: Dave Corsello [mailto:snort-users at ...15598...] 
Sent: Thursday, January 23, 2014 7:44 PM
To: snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] Pulledpork and proprocessor rules

Hi Ed,

Thanks for your reply.  Maybe I should be more specific in what I want
to do.  I currently have rules enabled by policy.  In addition, I want
to turn on just the two reputation preprocessor rules, 1:136 and 2:136. 
I don't see a way to accomplish that with the categories that you
provided.  What am I missing?

--Dave



Quick fix:

Copy and paste the two sigs into local.rules and change
sig_id...something like 1:136000001.

James




More information about the Snort-users mailing list