Oinkmaster is a great tool. It cannot replace a good IDS admin though.
If you are working in an environment where you need to look at every rule as
you are adding them then oinkmaster may not be right for you. I have recently
switched to "IDS policy manager" myself. I find myself changing to many new
rules as they are added. This is due to my environment. In many (Most)
environments you could probably cron oinkmaster to run nightly and just monitor
its change-log though.
So much depends on what you are doing. One nice feature of oinkmaster is the
ability to have it update from any ftp site. So you can set it to update from
an ftp server and ruleset that you control. Then you can have multiple clients
on one ruleset. This can really save hours or updates.
James Ashton
-----Original Message-----
From: snort-sigs-admin@lists.sourceforge.net
[mailto:snort-sigs-admin@lists.sourceforge.net] On Behalf Of Jose Maria Lopez
Sent: Tuesday, August 31, 2004 4:21 PM
To: snort-sigs@lists.sourceforge.net
Subject: Re: [Snort-sigs] Bleedingsnort.com Daily Update
El mar, 31 de 08 de 2004 a las 03:00, matt@infotex.com escribió:
[***] Results from Oinkmaster started Mon Aug 30 20:00:01 2004 [***]
[///] Modified active rules: [///]
-> Modified active in bleeding.rules (2):
old: alert ip any any -> any any (msg:"BLEEDING-EDGE Possible CIA
trojan activity"; content:"CIA 1."; content:"pass";
classtype:trojan-activity; sid:2001234; rev:1;)
new: alert ip any any -> any any (msg:"BLEEDING-EDGE Win32/Small.AR
outbound activity"; uricontent:"/zosman/cia/index.php";
classtype:trojan-activity; sid:2001234; rev:2;)
old: alert ip any any -> any any (msg:"BLEEDING-EDGE Possible CIA
Trojan/Backdoor download/upload attempt"; content:"|6C 75 66 6A 65 6F 6F|";
classtype:trojan-activity; sid:2001233; rev:1;)
new: alert ip any any -> any any (msg:"BLEEDING-EDGE Possible
Win32/Small.AR download/upload attempt"; content:"|6C 75 66 6A 65 6F 6F|";
classtype:trojan-activity; sid:2001233; rev:2;)
[+++] Added non-rule lines: [+++]
-> Added to bleeding-sid-msg.map (2):
2001233 || BLEEDING-EDGE Possible Win32/Small.AR download/upload
attempt
2001234 || BLEEDING-EDGE Win32/Small.AR outbound activity
[---] Removed non-rule lines: [---]
-> Removed from bleeding-sid-msg.map (2):
2001233 || BLEEDING-EDGE Possible CIA Trojan/Backdoor download/upload
attempt
2001234 || BLEEDING-EDGE Possible CIA trojan activity
[*] Added files: [*]
None.
I have read this message and I would like to know if oinkmaster
it's really capable of getting the new rules and add them without
touching the rules I have changed. This could be very important
for me, because when I install snort to a client they always want
rules to be updated automatically, but I always need to touch them
to make a good IDS.
So my question is: are you using oinkmaster to do this work? could
it do what I want it to do?
--
Jose Maria Lopez Hernandez
Director Tecnico de bgSEC
jkerouac@bgsec.com
bgSEC Seguridad y Consultoria de Sistemas Informaticos
http://www.bgsec.com
ESPAÑA
The only people for me are the mad ones -- the ones who are mad to live,
mad to talk, mad to be saved, desirous of everything at the same time,
the ones who never yawn or say a commonplace thing, but burn, burn, burn
like fabulous yellow Roman candles.
-- Jack Kerouac, "On the Road"
-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_idP47&alloc_id808&op=ick
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_idP47&alloc_id808&opÌk
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
