Snort mailing list archives
Re: Question about why/when VRT rules are commented out?
From: JJ Cummings <cummingsj () gmail com>
Date: Thu, 18 Feb 2010 11:23:51 -0700
Andy, if you look at the rule itself it has the balanced and security metadata information defined. These are the rulesets that this rule is defined to be "enabled" in by default. This metadata and capability to enable rules based on such metadata is one of the reasons (and thusly features) that were built into pulledpork. The VRT reviews a number of factors when determining if a rule should be enabled by default (in any base ruleset) and based on the result of this evaluation (that includes factors such as rule overhead, known false positive rate, impact, dispersion in the wild etc) the determination is made as to default state and inclusion of the various metadata that defines the respective (security, balanced or connectivity) based rulesets. A description of these base rulesets can be found in the README.RULESET of the current pulledpork tarball. JJC On Thu, Feb 18, 2010 at 11:10 AM, Andy Berryman <aberryman () cymtec com>wrote:
Just wondering why or how it is determined when sig's are commented out from the Certified VRT rule set? I was looking for the SID: 15481 Zbot sig this morning and saw that it was commented out in our Oinkmaster downloads. Just wondering why the #1 malware in the world would be commented out? Did it get replaced? I didn't see anything on snort.org or the forums or the mailing lists when I searched about it being removed or replaced. Thanks, Andy Berryman ------------------------------ This message from Cymtec Systems, Inc. contains confidential information and is solely for the use of the recipient(s) named above. If you are not the intended recipient or an agent responsible for delivering it to the intended recipient, you are hereby notified that you have received this message in error and that any review, disclosure, copying, distribution or use of the contents of this message is strictly prohibited. If you have received this message in error, please destroy it immediately and notify Cymtec Systems, Inc. by telephone at +1.314.993.8700 or by return e-mail. ------------------------------ ------------------------------------------------------------------------------ Download Intel® Parallel Studio Eval Try the new software tools for yourself. Speed compiling, find bugs proactively, and fine-tune applications for parallel performance. See why Intel Parallel Studio got high marks during beta. http://p.sf.net/sfu/intel-sw-dev _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------------------------------ Download Intel® Parallel Studio Eval Try the new software tools for yourself. Speed compiling, find bugs proactively, and fine-tune applications for parallel performance. See why Intel Parallel Studio got high marks during beta. http://p.sf.net/sfu/intel-sw-dev
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Question about why/when VRT rules are commented out? Andy Berryman (Feb 18)
- Re: Question about why/when VRT rules are commented out? JJ Cummings (Feb 18)