Snort mailing list archives
Signatures and Rulesets
From: amit82 () me com
Date: Thu, 22 Mar 2012 16:30:13 +0000 (UTC)
Hi everyone, I am using Snort 2.9.2 and pulledpork to pull latest paid subscription rulesets. I am just curious with preprocessor and decorder alerts disabled I was wondering how many rulesets are actually active to alert me on security events. Pulledpork gives following stats Rule Stats.... New:-------134 Deleted:---3 Enabled Rules:----2803 Dropped Rules:----0 Disabled Rules:---9571 Total Rules:------12374 DoneI am guessing 2803 rules are actually enabled (rules and so rules combined). Please correct me if I am wrong.
So does Snort enable only priority rules and disables rules that were written to catch old/older attacks/issues/risks? Just wondering how Snort priorities signatures in its every release. Are these signatures enough to catch most common anomalies or issues, is the number comparable to what other vendors release? Thanks, Ams.
------------------------------------------------------------------------------ This SF email is sponsosred by: Try Windows Azure free for 90 days Click Here http://p.sf.net/sfu/sfd2d-msazure
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Signatures and Rulesets amit82 (Mar 23)