On Tue, 21 Feb 2006, Christina McAghon wrote:
I am running snort v2.3.3. I would like to change the priority of a few
certain rules (without affecting the default classification.config
priority). I thought I could achieve this by copying the rule from its
rule file into local.rules. In local.rules, I added the priority
classification. Here's an example:
I think that's generally a bad way to customize rules unless you're
careful. Moving a rule into local.rules usually means it will be
forgotten and stay there untouched forever, i.e. if the official
version of it gets updated, you would still have the old one.
Now some shameless plugs...
I would use the "modifysid" function in Oinkmaster
(http://oinkmaster.sf.net/) to customize the rules instead. This way you
can continue to use the latest and greatest rules automatically while
still being able to tweak them, like changing the priority.
I tried to document these things in the Oinkmaster FAQ (Q21).
By the way, if you really ment Snort 2.3.3, you should upgrade to
2.4.3 ASAP. See the warning at http://www.snort.org/dl/old/ if you
don't believe me.
/Andreas
-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems? Stop! Download the new AJAX search engine that makes
searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
