Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Snort-Users
[Top] [All Lists]

[Snort-users] oinkmaster - disabling rules without getting new updates

Subject: [Snort-users] oinkmaster - disabling rules without getting new updates
Date: Mon, 19 Sep 2005 17:12:23 -0400
I just setup oinkmaster to update our rules.  Let's say that a rule
suddenly starts generating thousands of false positive alerts, and we
want to disable the rule.  Normally I would add a disablesid line to the
conf file and run oinkmaster.  But, that's going to update my rules with
the latest rule set, which may or may not be what I want.  If it's late
on a Friday afternoon, I don't want to introduce new rules that may
false positive over the weekend.  The oinkmaster documentation is fairly
insistent about not editing the rules files directly.  But, one approach
is to edit the appropriate rules file and restart snort, and also edit
the oinkmaster.conf file to make certain the rule does not get
re-enabled.  Another possibility is to run oinkmaster using only local
copies of the rules archives so it doesn't update from the URLs.  But,
that introduces an extra step of having to manually download the
updates.  Yet another approach would be to run oinkmaster interactively,
and just reject all the changes with the exception of the one I added.
Ideally, I think that there should be an oinkmaster option for this to
minimize extra steps and to keep people from editing the rules files
directly.  Thoughts?

Thanks.

--Dave
<Prev in Thread] Current Thread [Next in Thread>