[Snort-users] Using both Snort registered rules and community rules

Joel Esler (jesler) jesler at cisco.com
Fri Jan 11 15:26:21 EST 2019



> On Jan 11, 2019, at 12:45 PM, Black Lion via Snort-users <snort-users at lists.snort.org> wrote:
> 
> Hi. I have read online that the Snort community rules are part of the Snort registered rules.

True.

> However, I have also read that both of these rules should be enabled. Why is this the case, if the community rules are already included with the Snort registered rules?

The community rules are updated daily.  The registered rules are 30 days behind.

--
Joel Esler
Manager, Communities Division
Cisco Talos Intelligence Group
http://www.talosintelligence.com

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20190111/a208945b/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3010 bytes
Desc: not available
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20190111/a208945b/attachment.bin>


More information about the Snort-users mailing list