Re: snort ... so where from here

[Seth <sethsec () gmail com>]

Brent,

You CAN, but most people do not, enable all of the signatures.  An
easy start would be to take a look at the end of your snort.conf.
Each .rules file referenced is a group of signatures of the same type.
 The default snort.conf has some entire rule sets disabled by default.
 You are encouraged to look through the list and pick which sets would
be most appropriate for your environment.  Enabling the
spyware-put.rules on a sensor that protects only web servers might not
be the best use of resources on an older box.   In a situation like
that, just comment the spyware-put.rules line and enable all of the
rules files that you feel would be appropriate.

After you choose which entire sets you would like to have
enabled/disabled, then you can move on to disabled certain signatures
in the oinkmaster.conf.

-Seth



On Thu, Jul 10, 2008 at 8:00 AM, Brent Clark <brentgclarklist () gmail com> wrote:
> Hi List
>
> I got the oinkmaster working and updating, but what interested me is
> that the load average shot up just after i ran the update (specs of the
> machine arnt great).
>
> My question is, are we supposed to use ALL signatures offered, or what
> method / practices is adopted or used.
>
> Thank you in advance for you assistance in advance.
>
> Regard
> Brent Clark
>
>
>
> -------------------------------------------------------------------------
> Sponsored by: SourceForge.net Community Choice Awards: VOTE NOW!
> Studies have shown that voting for your favorite open source project,
> along with a healthy diet, reduces your potential for chronic lameness
> and boredom. Vote Now at http://www.sourceforge.net/community/cca08
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

-------------------------------------------------------------------------
Sponsored by: SourceForge.net Community Choice Awards: VOTE NOW!
Studies have shown that voting for your favorite open source project,
along with a healthy diet, reduces your potential for chronic lameness
and boredom. Vote Now at http://www.sourceforge.net/community/cca08
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users