snortcenter question

["James M. Driskell" <jdriskell () ups edu>]

Hi All,

 

I've just installed v 1.0 of snortcenter and have it controlling 2
sensors with different configurations.  Is there an easy way to manage
the different configurations while tuningthe sensors?   Do I create
templates for each sensor?     Where can I find some docs for
snortcenter?

 

Any help will be appreciated.  Thanks,

 

Jim Driskell

 

PS - I've placed one of the sensors on the uplink of one of my internal
subnets.  I'd like to view activity coming from this subnet as though it
were from outside, so my thought was to set the var EXTERNAL_NET to this
subnet and set the var HOME_NET to !$EXTERNAL_NET.  Is there a better
way? 

 

Thanks again.