We've had a lot of interest and new rules submitted in the virus and
work arena since we started bleedingsnort. That's been a difficult thing
to do in the official sets because of the speed of propagation and the
number of variations that are inevitably seen for any successful worm or
virus.
The Bleeding snort project is better suited to handle the change load,
and so we're going to fork another set of rules called the
bleeding-virus ruleset. this will be handled just like the
bleeding-malware ruleset. It'll be a separate text file available direct
or via the tarballs we distribute.
READ THIS IF YOU'RE JUST SKIMMING THIS EMAIL!!!
You need to add this to your snort.conf:
include $RULE_PATH/bleeding-virus.rules
YOU MAY CONTINUE SKIMMING.....
We don't intend to do a significant amount of future ruleset forking.
This and the malware set are forked because of their disparate interest,
and the amount of changes each will endure. Many admins using bleeding
rulesets use just one or the other but not both, or don't want certain
sets on certain sensors. This makes it easier for you to comment out an
entire ruleset rather than tracking and disabling sids, etc.
These changes will be reflected in the bleeding snort rules shortly.
We'd also like to thank Michael Sconzo and his peers at the Netsquid
project. We'll be pulling their rules into the new virus rulesets on
bleedingsnort.com. They've done some great signature work, and have a
very effective tool. We recommend giving it a look if you've got a
relatively uncontrolled net that needs some taming (like a university
network, etc). http://netsquid.tamu.edu/main.html
And as always, please speak up if any of these changes break something,
have typo's (which we're really good at), or you see a better way to do it.
Thanks
Matt
-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
