Snort mailing list archives
Re: SnortCenter sensor "cloning"
From: "larc" <larc () pandora be>
Date: Fri 06 Dec 2002 17:16:36 +0100
Hi, This is a problem with the current version, in the next version you will be able to put your enabled rules in templates. Then you just need to activate a one template. I hope to finish it before the end of the year. For now if you edit the file add_sensor.php and change in the sql queries sensor_name = 'default' to sensor_name = 'an existing sensor name' Then when you add a new sensor it will clone the other sensor. Cheers, Stefan D. ------------------------ scp () hushmail com wrote: ------------------------ -----BEGIN PGP SIGNED MESSAGE-----
Hello all, What would be the best way to "clone" a sensor in SnortCenter? I have several "classes" (extranet, internet, internal.. etc) of sensors, but each one needs to be slightly different, so I do not what to group them. It seems like each time I deploy a sensor, I dread going through and disabling and enabling tons of rules. Having a generic "Default" sensor helps little, because of my different "classes" of sensors. Is there something I am missing? Is there a feature or better way of managing my sensors in SnortCenter? Thanks in advance, scp -----BEGIN PGP SIGNATURE----- Version: Hush 2.2 (Java) Note: This signature can be verified at https://www.hushtools.com/verify wlgEARECABgFAj3wseoRHHNjcEBodXNobWFpbC5jb20ACgkQiLP8kOqBWAhBGQCeOsai 575vUiUP5yI0XUe8V79xofYAoKKC+rO8CXq7P9xkOOhxnaz8eZyu =DX0/ -----END PGP SIGNATURE----- Concerned about your privacy? Follow this link to get FREE encrypted email: https://www.hushmail.com/?l=2 Big $$$ to be made with the HushMail Affiliate Program: https://www.hushmail.com/about.php?subloc=affiliate&l=427 ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- SnortCenter sensor "cloning" scp (Dec 06)
- <Possible follow-ups>
- Re: SnortCenter sensor "cloning" larc (Dec 06)
- SnortCenter sensor "cloning" scp (Dec 09)