Snort mailing list archives
Re: Using PP
From: Peter Bates <peter.bates () ucl ac uk>
Date: Thu, 13 Sep 2012 11:37:57 +0100
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello all On 13/09/2012 11:18, Pratik Narang wrote:
I already had some 4K rules enabled manually, i.e. without PP. Now with PP managing and enabling my rules (I used 'security' policy), do I need to simply forget whatever I had enabled earlier and start afresh, or is there some workaround so that I can still have those previous rules around and can enable/disable them with PP as per need???
In pulledpork.conf, if you have state_order=disable,drop,enable enablesid=/usr/local/etc/snort/enablesid.conf In enablesid.conf you can have a list of SIDs you would like to keep enabled if there are some you know are useful/valuable: 1:17114 # WEB-CLIENT Microsoft SilverLight ImageSource RCE attempt 1:23262 # Trojan.Banker 1:23173 # Android Zitmo trojan - -- Peter Bates Senior Computer Security Officer Phone: +44(0)2076792049 Information Services Division Internal Ext: 32049 University College London London WC1E 6BT -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.17 (MingW32) Comment: Using GnuPG with Mozilla - http://www.enigmail.net/ iQEcBAEBAgAGBQJQUbeFAAoJELhVoVpEMS6Rx0kH/iEtAWptAYzfWRSGqW5B2/z8 Zp4ygK18L4AHtuhI5DIcwG/y+p9VAM+CAFekMTqiPDsp+x/z2eRMmwRejtnFdX0R POEXOTv3r8Lw5SEvXR0SNDuPL/PCsO139aUlUy9UBp/QVxQ7lkWLlEHDriXqhG/2 7gFqAW/DdIhLk0l6kd8gaCpsPkz1vYwnlFeYwkF5V372ulMgFZHT3MF+7xFdnLLW NG6ECfeypXh8LI24jT2LMKeufXHwhMJOJFQwMKqfNve1LAvKOJoNpEU+kWNFQVXT 7QafGzCVmtclN6RbTrEHpLAnuiKUYiNdwxPJVrFSo8f4qtdcJhpo7wCqU8aqUAg= =K6DJ -----END PGP SIGNATURE----- ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Using PP Pratik Narang (Sep 13)
- Re: Using PP Heine Lysemose (Sep 13)
- Re: Using PP Pratik Narang (Sep 13)
- Re: Using PP Heine Lysemose (Sep 13)
- Re: Using PP Pratik Narang (Sep 13)
- Re: Using PP Peter Bates (Sep 13)
- Re: Using PP Pratik Narang (Sep 13)
- Re: Using PP John York (Sep 13)
- Re: Using PP Michael Steele (Sep 13)
- Re: Using PP Heine Lysemose (Sep 13)