Snort mailing list archives
Re: modifying priority on certain rules
From: Christina McAghon <cmcaghon () sungardsct com>
Date: Tue, 21 Feb 2006 17:52:24 -0500
Thanks for the feedback. However, the problem isn't with how I change the rule, it's the fact that the updated priority isn't taking effect. In my oinkmaster.conf, I added the line: modifysid 2466 "classtype:protocol-command-decode;" | "classtype:protocol-command-decode; priority:2;" That successfully updates the rule, but the priority is still coming through as the default (3). Thanks again, oinkmaster is great ;) Christina Andreas Östling <andreaso () it su se> 02/21/2006 05:30 PM To Christina McAghon <cmcaghon () sungardsct com> cc snort-users () lists sourceforge net Subject Re: [Snort-users] modifying priority on certain rules On Tue, 21 Feb 2006, Christina McAghon wrote:
I am running snort v2.3.3. I would like to change the priority of a few certain rules (without affecting the default classification.config priority). I thought I could achieve this by copying the rule from its rule file into local.rules. In local.rules, I added the priority classification. Here's an example:
I think that's generally a bad way to customize rules unless you're careful. Moving a rule into local.rules usually means it will be forgotten and stay there untouched forever, i.e. if the official version of it gets updated, you would still have the old one. Now some shameless plugs... I would use the "modifysid" function in Oinkmaster (http://oinkmaster.sf.net/) to customize the rules instead. This way you can continue to use the latest and greatest rules automatically while still being able to tweak them, like changing the priority. I tried to document these things in the Oinkmaster FAQ (Q21). By the way, if you really ment Snort 2.3.3, you should upgrade to 2.4.3 ASAP. See the warning at http://www.snort.org/dl/old/ if you don't believe me. /Andreas
Current thread:
- modifying priority on certain rules Christina McAghon (Feb 21)
- Re: modifying priority on certain rules sekure (Feb 21)
- Re: modifying priority on certain rules Andreas Östling (Feb 21)
- Re: modifying priority on certain rules Christina McAghon (Feb 21)
- Re: modifying priority on certain rules Andreas Östling (Feb 22)
- Re: modifying priority on certain rules Dirk Geschke (Feb 22)
- Re: modifying priority on certain rules Christina McAghon (Feb 21)
- <Possible follow-ups>
- Re: modifying priority on certain rules Christina McAghon (Feb 22)
- Re: modifying priority on certain rules Frank Knobbe (Feb 22)