There are a few ways to do it, the easiest is one of the following:
1. You can disable groups of rules in snort.conf by commenting out (#) the
relevant line -
Ex: include $RULE_PATH/nntp.rules -> #include $RULE_PATH/nntp.rules
- OR -
2. You can comment out specific rules located in the rules directory, i.e.
if you're running IIS and want to disable WebDAV rules, comment out the
relevant WebDAV signatures.
Keep in mind that defining variables in your snort.conf file is an effective
method of tuning the policy.
Good luck
~ adam
-----Original Message-----
From: snort-users-admin@lists.sourceforge.net
[mailto:snort-users-admin@lists.sourceforge.net] On Behalf Of sEc nErD
Sent: Sunday, January 30, 2005 12:46 PM
To: Snort-users@lists.sourceforge.net
Subject: [Snort-users] Snort Basica Help on tuning signatures
hi all
Could anybone walk me through of how to go about tuning the snort signatures
,like how i could disable and enable them thanks
__________________________________
Do you Yahoo!?
Yahoo! Mail - You care about security. So do we.
http://promotions.yahoo.com/new_mail
-------------------------------------------------------
This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
Tool for open source databases. Create drag-&-drop reports. Save time
by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
Download a FREE copy at http://www.intelliview.com/go/osdn_nl
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
-------------------------------------------------------
This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
Tool for open source databases. Create drag-&-drop reports. Save time
by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
Download a FREE copy at http://www.intelliview.com/go/osdn_nl
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
