No, we don't do any signature management with Sguil. I suggest using
oinkmaster [0].
Bammkkkk
[0] http://oinkmaster.sourceforge.net/
On 9/12/06, Joel Esler <joel.esler@sourcefire.com> wrote:
First off, ditch ACID. :-) Use BASE. base.secureideas.net ACID is dead.
There's a couple ideas I can give you, one: IDSPM from
http://www.activeworx.org
two: http://www.sourcefire.com :)
three: Sguil (Bamm, am I right with that?)
I think I heard of a SnortCenter2 as well. Try checking for that.
Also, if you are editing the Sourcefire signatures, it's recommended that you
copy the rule you are editing to local.rules, edit it, and shut off ours
using oinkmaster, and in the rules file.
Also, ensure that your variables are accurate as well.
Joel
On Sun, Aug 27, 2006 at 12:13:28PM -0400, martin apparently sent me:
I have a Snort-Mysql-Acid-Snortcenter setup.
I am using Snortcenter to update my signature files to my 6 sensors.
The problem I am having is Snortcenter does not edit the signatures
correctly in the DB so my Snortcenter updates overwrite my exisiting
changes in the snort.conf files (any tuning or removing of
signatures).
What alternative is there to snortcenter that I can use to tune
signatures from a central location and push out?
thanks
-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job
easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
+---------------------------------------------------------------------+
joel esler senior security consultant 1-706-627-2101
Sourcefire Security for the /Real/ World -- http://www.sourcefire.com
Snort - Open Source Network IPS/IDS -- http://www.snort.org
gpg key: http://demo.sourcefire.com/jesler.pgp.key
aim:eslerjoel ymsg:eslerjoel gtalk:eslerj
+---------------------------------------------------------------------+
-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
--
sguil - The Analyst Console for NSM
http://sguil.sf.net
-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
