Re: DB Rules

[Chris Green <cmg () uab edu>]

Charles Henrich <henrich () sigbus com> writes:

> It would be really cool if snort could read its rulesets from the database
> source.  That way remote sensors who are talking directly to the central DB
> server could get immediate rule updates, and make administration of a snort
> network much easier.. (IMHO).  Whacha think?

I've done a small bit of work on that.  Desiging the schema isn't too
bad and writing a parser for the snort rules language isn't too bad (
doable in a weekend ) but keeping up with Marty and new
options/features can be bad :)

I will admit I have a bit of difficulty writing a lex/yacc type
grammar for the rule set b/c it's got a lot of separte rules for
tokenization and I'm no compiler whiz.

At snort 2.0, the a goal is to have a modular rules engine so everyone
can write whatever type of rule engine they would like.
-- 
Chris Green <cmg () uab edu>
I've had a perfectly wonderful evening. But this wasn't it.
     -- Groucho Marx

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users