El miÃ, 01 de 09 de 2004 a las 11:57, James Ashton escribiÃ:
Oinkmaster is a great tool. It cannot replace a good IDS admin though.
If you are working in an environment where you need to look at every rule as
you are adding them then oinkmaster may not be right for you. I have
recently switched to "IDS policy manager" myself. I find myself changing to
many new rules as they are added. This is due to my environment. In many
(Most) environments you could probably cron oinkmaster to run nightly and
just monitor its change-log though.
I'll give it a try anyway, I've been reading the documentation
and it seems to work well at least in theory. If it respects my
changes on the main rules then it will be useful to me.
So much depends on what you are doing. One nice feature of oinkmaster is the
ability to have it update from any ftp site. So you can set it to update from
an ftp server and ruleset that you control. Then you can have multiple
clients on one ruleset. This can really save hours or updates.
That could be a great possibility for me, just make the changes
every week or so and make oinkmaster ftp my site to get the new
rules for each main client. Sounds great.
James Ashton
Thanks for your advice.
--
Jose Maria Lopez Hernandez
Director Tecnico de bgSEC
jkerouac@bgsec.com
bgSEC Seguridad y Consultoria de Sistemas Informaticos
http://www.bgsec.com
ESPAÃA
The only people for me are the mad ones -- the ones who are mad to live,
mad to talk, mad to be saved, desirous of everything at the same time,
the ones who never yawn or say a commonplace thing, but burn, burn, burn
like fabulous yellow Roman candles.
-- Jack Kerouac, "On the Road"
-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_idP47&alloc_id808&opÌk
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
