Re: SnortCenter Configuration

[Joerg Weber <j.weber () infos de>]

Hi Roy,

I just can't find the mail in the archives right now, but if I'm not
mistaken are the rules on the net for some reason formated in a way that
snortcenter won't read them anymore (I think Stefan mentioned something
about a comment field but I could be wrong).
What I do is cat the rules into one big rulefile and upload that
manually once, then do the updates in little chunks.

Hope that helps,

Joerg

> I actually had Snort working well in standalone mode, and I'm trying to
> integrate it into SnortCenter (so I'll initially have SnortCenter manage
> one agent).  SnortCenter and Agent talk well with each other; I've
> uploaded the config file I was using originally, but I'm having a
> problem with the rules.  Specifically, if I do admin->import/update
> rules->update from internet, I get "No update this time..." which is not
> necessarily all that descriptive.  Nothing new? Couldn't find anything
> Dunno.
>
> I obviously don't want to hand-enter a whole bunch of different rules.
> Any suggestions?
>
> -roy
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: eBay
> Get office equipment for less on eBay!
> http://adfarm.mediaplex.com/ad/ck/711-11697-6916-5
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
-- 
Joerg Weber
Network Security

infoServe GmbH
Nell-Breuning-Allee 6
D-66115 Saarbruecken

T: (0681) 8 80 08 - 0
F: (0681) 8 80 08 - 59
www.infos.de
E: j.weber () infos de

Attachment: signature.asc
Description: This is a digitally signed message part