snorcenter2, Base, bleeding rules and sid-msg.map

[John Hally <JHally () epnet com>]

Hello All,

 

I've set up the latest version of snortcenter2 with the rule_combine script
working great fetching snort and bleeding snort rules.  I did some poking
around and it doesn't look like the script handles merging the sid-msg.maps
from the two different rulesets. What sid-msg.map is used, the one on the
BASE install, snortcenter2 install, or on the sensor(s)?

 

Thanks in advance!