FYI, there are some changes in the upcoming Oinkmaster 1.1 that will let you
specify SIDs that should never be updated (i.e. rules to always keep the
local version of, even if the new version is different).
Personally I'm not too thrilled about this feature because I think that this
is usually not the best way to solve the problem. I prefer the way Hugo
suggested, or by applying a simple substitution expression on rules that need
to be slightly customized after each update by using 'modifysid' in
Oinkmaster. (By customized I mean modified in other ways than simply enabling
or disabling them).
The changes are in
http://oinkmaster.sourceforge.net/oinkmaster-snapshot.tar.gz
if you want to try it. The included oinkmaster.conf and the FAQ (mostly Q21)
contains some docs regarding this issue, but keep in mind that they very much
reflect my personal opinions and those may not be valid in your
environment :)
/Andreas
On Tue, 31 Aug 2004, Jose Maria Lopez wrote:
I have read this message and I would like to know if oinkmaster
it's really capable of getting the new rules and add them without
touching the rules I have changed. This could be very important
for me, because when I install snort to a client they always want
rules to be updated automatically, but I always need to touch them
to make a good IDS.
So my question is: are you using oinkmaster to do this work? could
it do what I want it to do?
-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
