Re: [Snort-sigs] Community Rule Update

On Monday 04 April 2005 15:11, Alex Kirk wrote:
> As to the idea of a VALID_PROXY_SERVERS variable, it makes sense -- *if*
> you've gone through as an admin and defined that variable. The problem
> is, for people who are just letting Oinkmaster grab new rules without
> touching their conf, this rule would break Snort, since they wouldn't
> have that variable defined. That said, though, it's a good way to cut
> down false positives if you take the time to define the variable, so
> I'll add your suggestion to the doc.
>
> Alex Kirk
> Research Analyst/
> Community Rules Maintainer
> Sourcefire, Inc.

That's exactly what the -U flag in Oinkmaster is there for, i.e. merge new 
variables into your local snort.conf so Snort doesn't break when there are 
new variables introduced in the downloaded rules.
I'm not sure anyone is actually using it, but it's there :)

/Andreas


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs