RE: Snort Basica Help on tuning signatures

[<adamk () computer org>]

There are a few ways to do it, the easiest is one of the following:
1. You can disable groups of rules in snort.conf by commenting out (#) the
relevant line -
Ex: include $RULE_PATH/nntp.rules -> #include $RULE_PATH/nntp.rules
- OR -
2. You can comment out specific rules located in the rules directory, i.e.
if you're running IIS and want to disable WebDAV rules, comment out the
relevant WebDAV signatures.

Keep in mind that defining variables in your snort.conf file is an effective
method of tuning the policy.

Good luck
~ adam

 

-----Original Message-----
From: snort-users-admin () lists sourceforge net
[mailto:snort-users-admin () lists sourceforge net] On Behalf Of sEc nErD
Sent: Sunday, January 30, 2005 12:46 PM
To: Snort-users () lists sourceforge net
Subject: [Snort-users] Snort Basica Help on tuning signatures


hi all
Could anybone walk me through of how to go about tuning the snort signatures
,like how i could disable and enable them thanks


        
                
__________________________________ 
Do you Yahoo!? 
Yahoo! Mail - You care about security. So do we. 
http://promotions.yahoo.com/new_mail


-------------------------------------------------------
This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
Tool for open source databases. Create drag-&-drop reports. Save time
by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
Download a FREE copy at http://www.intelliview.com/go/osdn_nl
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users



-------------------------------------------------------
This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
Tool for open source databases. Create drag-&-drop reports. Save time
by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
Download a FREE copy at http://www.intelliview.com/go/osdn_nl
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users