Newbie (well sort of) to snort......

["SAWYER Charlotte M" <Charlotte.M.Sawyer () state or us>]

I've searched the internet and email list archives and found some near
answers, but nothing that definitively answered my question.
 
I've read some of the stuff on RTN/OTN parsing and it didn't help me
much.  Sorry.
 
I understand that the .conf file and rules files are read into a
decision tree-linked list memory environment for snort to work with.
What I'm not so clear on is if the order of the rules is maintained when
it's loaded in.
 
One reference (don't remember now where I saw it) said that the rules
files can be considered as AND statements and the rules with in a
particular file can be considered OR statements.
 
I've been experimenting with adding rules to ignore some traffic that is
generating false positives.  In one situation I want to ignore traffic
that ALMOST matches the web-attacks rm command alert.  I'm seeing a fair
amount of alerts where the rm%20 is actually a part of Form%20 or some
other string.  I'd like to not have to review those alerts but I don't
want to select based on IP, I want to check for the content and not
alert if it has Form%20 in it.
 
Because I'm new to editing rules, I wanted to have the regular rule
trigger as well as my changed one.  Guest that's not an option.
 
Anyway, the results were not what I expected.......I didn't see any
alerts with Form%20 in them, but neither did I see the ones that would
match on Confirm%20.
 
I'm sooo confused.  :-)  Thanks in advance for any help/suggestions/etc.