Re: Reputation blacklists and snort_control

[Stanford Prescott <stan.prescott () gmail com>]

Ah, that makes sense. Thanks, Joel!

On Thu, Mar 16, 2017 at 8:24 AM, Joel Esler (jesler) <jesler () cisco com>
wrote:

> You have to turn the rules on in the preprocessor.rules.
>
> --
> Sent from my iPhone
>
> On Mar 16, 2017, at 08:28, Stanford Prescott <stan.prescott () gmail com>
> wrote:
>
> > > From some researching I have been doing about the reputation
> preprocessor,
> > I have read that reputation IP blacklists need to have alerts (gids sids)
> > created for the IPs. But when I have downloaded the Talos IP lists and
> > loaded them via the snort control socket using pulledpork I can't see
> that
> > any alerts rules for the IPs have been created.
> >
> > I am using snort 2.9.9.0 with the appropriate config options for the
> > reputation preprocessor and snort_control and library .so dependencies
> with
> > successful loading messages from snort in the log files. Using the
> loading
> > of the IP lists via snort_control, are alerts rules created anywhere for
> > the IP lists?
> > ------------------------------------------------------------
> ------------------
> > Check out the vibrant tech community on one of the world's most
> > engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
> >
> > Please visit http://blog.snort.org to stay current on all the latest
> Snort news!
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!