Re: Automatic Snort Ruleset Updates through Scripting

[Nigel Houghton <nhoughton () sourcefire com>]

On Monday, June 28, 2010, Randal T. Rioux <randy () procyonlabs com> wrote:
> 0. Top posting releases demons into email threads. But my diatribe gets old.

Posting in the middle makes the baby Jesus cry

> 1. Who handles the Oinkcodes? BTW, I've never used Oinkmaster, which
> leads me to this question: What the hell is an Oinkcode?

You do, from your account on snort.org. You click something, and you
get one. It's a token that belongs to you, identifies you so you can
download stuff.

> 2. <blank stare, looks to left, switch to right>

The chicken is down.

> Randy
>
> PS Just noticed Watchinski is on my neighborhood board - Long Reach
> represent! (I thought that name looked familiar so I went through my
> stack of mail :-)

Taking over the world, one neighborhood at a time.

> On 06/27/2010 09:43 PM, JJ Cummings wrote:
> > 1. Oinkmaster is neither provided nor maintained by Sourcefire.
> >
> > 2. What if I want to use so rules?
> >
> > Sent from the iRoad
> >
> > On Jun 27, 2010, at 17:28, David Gullett <dgullett () symmetrixtech com
> > <mailto:dgullett () symmetrixtech com>> wrote:
> >
> > > For beginners to the world of Snort, we've published a new guide today
> > > that builds on our previous Snort setup documents. It describes a
> > > method to automatically update the Snort 2.8.6 rulesets using
> > > Oinkmaster and to also update the Ubuntu 10.04 LTS operating system
> > > using Aptitude - both through a bash script.
> > >
> > > And hey, you don't have to register to download. The information is
> > > available at this URL which provides a direct link to the article I've
> > > just described and the direct link to the most recent Snort setup
> > > guide:
> > > <http://www.symmetrixtech.com/articles/007-updatingsnortandubuntu.html>http://www.symmetrixtech.com/articles/007-updatingsnortandubuntu.html
> > >
> > > Feel free to comment on our poor bash scripting skills...
>
> ------------------------------------------------------------------------------
> This SF.net email is sponsored by Sprint
> What will you do first with EVO, the first 4G phone?
> Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

-- 
Nigel Houghton
Head Mentalist
SF VRT
http://vrt-sourcefire.blogspot.com && http://labs.snort.org/

------------------------------------------------------------------------------
This SF.net email is sponsored by Sprint
What will you do first with EVO, the first 4G phone?
Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users