Re: Snort Rule management
Ian via Snort-sigs <[email protected]>
| Newsgroups | gmane.comp.security.ids.snort.sigs |
|---|---|
| Message-ID | <mNG0NAwls3haVwzULrTG6b3pAxj7YvI5h39Zrm4-h65kXw6lM0AoABL0QKITIi4HT652AMCyBzlUidI21oQhfvvslyI-aWXlG2fu6VGFQ1Q=@protonmail.com> |
Hi Marc, Aside from commenting/removing the rules out of your snort.conf file I'm not sure there is any "better way". Keep in mind I am only familiar with Snort in lab environments, my team has not been able to use snort in production. This page is my go-to though, I would look through the manuals section near the bottom. Snort.org Snort3 Resources Hope that helps some. Take care. -----------------------------------------------------------Ian Sent with ProtonMail Secure Email. ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐ On Sunday, September 5th, 2021 at 9:29 AM, Marc <[email protected]> wrote: > Hi, > > What would be a good reference on managing (not writing) Snort3 Rules? Specifically, I am running Snort 3.1.6 with SO rules and Pulled Pork. I am having difficulty removing rules (e.g. a noisy ICMP rule ). I am looking for a concise reference or alternately a tutorial on commenting out rules and recompiling them. I have tried commenting out the rule in pulledpork.rules and local.rules and restarting Snort, but that didn’t do it. Thank you. > > Regards, > > Marc _______________________________________________ Snort-sigs mailing list [email protected] https://lists.snort.org/mailman/listinfo/snort-sigs Please visit http://blog.snort.org for the latest news about Snort! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette Visit the Snort.org to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a href=" https://snort.org/downloads/#rule-downloads">emerging threats</a>!
publickey - [email protected] - 0x667ABB5F.asc
(application/pgp-keys, 1.8 KB)
-----BEGIN PGP PUBLIC KEY BLOCK----- Version: OpenPGP.js v4.10.10 Comment: https://openpgpjs.org xsBNBFyRq9IBCACyI3UJMOMH+h5dqg7w3lDk81BWJMXHkdVG9lvGwsk+3f7g xSZmTdzze53j7OTXQphfwCb2Cs8/XbV02SUlRB1nwY4AzXFeS4Qvo5BhSpIS Tn7uWTAXKn2g8k/xzz72I7NLVWOlSWPDJKc2sd4EMVv6Fl9pD4IF4Y/cZYMZ dpRzGmYRiejVDdfJan6rT/zXa7jqg4cLDZczBE4rKcXFXBDdzyH5+L5EToxo mWWhmWnSrzIo4gTFbiy+4hw6LAuJw/x7M808XFe8tKnZ3mx8M0uqFARf5rHO +rI6OYhrSh27HK/8y0B/RjOGOeZYTMHdys1zyQyaLIPXetul9/G4MFXxABEB AAHNNyJoYXJ0ZXNjb3V0QHByb3Rvbm1haWwuY29tIiA8aGFydGVzY291dEBw cm90b25tYWlsLmNvbT7CwHUEEAEIAB8FAlyRq9IGCwkHCAMCBBUICgIDFgIB AhkBAhsDAh4BAAoJEJqc/+y4eoJxK68H/RzqFpCstAD1plzcSFLT7MVu7sbw adK2iGhAQP5b7/RUhO10heERZPMdGnJaff/jEUFPb9DnVVHNzQWIJMHwiZSc +TbxJNzR4SEwC1wd63AQzMJxkc6wjU2Kfx1qdUjGXhnn+E6gO/VISTSeHiXP 6m4dU+gMfDnVp5EGR5tJTrjlNgcKzm306vNLxSsxiv6T6nBKn5bc2EplW8Iq 22OzxmTr+6jp+iS96RWdZVM7wxSefovKE/EACedBHOoOQpyjEmW0Gmp2ph74 WVS8UdF2WwTD2TIy6ndrr509fjOTdR8o5Q5RqL1/7E/qDNz+1qC/1JlQqpva s3/GcWuvREVsb4DOwE0EXJGr0gEIAM6i0xUhJOB17qx0TMA/RwZ2SPz3nN3/ +Hs8pOQHPy+w1yAFJY68wnZhVZStnpwWEzMQGQuxgc1nDz1EHsC5uhAob/5f 45klYHDhdEDWLV4w3Seb4AGpHRWPRw9ApUcZ3MxbY7PbFlSnAgV+862KaOhS QJ+SNqjOecQbQ+T56JSQw4uhCMV4eMZy2VYmZOsZt3hmMzVMQ5AmdpJdIkiC YWE8BsY+FiiyNacxa8DWTrmQDRdjPnZlAAqad+xNEIKWyUVRQMIge0pebOgv X2z+DRxue8JpjEWO/j8WHQ2JDtArcu7YlfvneqICxS0YDLBt/NrkbFK4v7NM X8sYCoo2T4cAEQEAAcLAXwQYAQgACQUCXJGr0gIbDAAKCRCanP/suHqCcTr+ B/9iLZFR7UD99jhZEFvobDWUEQaSfKTR/s5SzFFBdHo6l23dlSXvu/tU4aBX lipjFJ9XLEA6t4vwDp61rSGxfZHHgI4V8D/gfv9WpmX7s9MHJ6qoQYt+Bcd3 Y31bqjXkJwusMEL70j5xjxGIFVzhQcRqqgiRf+A9oLIpiUAnoIdWR8/T7Uxi lnENqxLl15mFeOFp2tTnaPJ9HerBcSmK34/vURpPcT3vTguafTpfnomzBag8 flqk8wQ2uISgW8JXceS9N3QSQIBUrB6hWUuRy4XH1DcHIqbWtRQTknF1XB5R lcy4Aeevnoc5XKiJWEmG1mkf1gMq14u97pNKYn7D1Nbt =ReuV -----END PGP PUBLIC KEY BLOCK-----
signature.asc
(application/pgp-signature, 509 B)
-----BEGIN PGP SIGNATURE----- Version: ProtonMail wsBzBAEBCAAGBQJhNbS8ACEJEJqc/+y4eoJxFiEEZnq7X6w64RXg3LdOmpz/ 7Lh6gnGIfQgAkI1m3kGxJP/IjkheDHA3YZAH7E/eyqDhuacnWIt1wmo5+tY4 FGNQYax1KkCXMEoI9zvwZIn4VOFt+e/GF/KLtC3S4IbwdzB8UsIr8P5qsRo0 x+/RTgg7FVkNkSALud5wMb15ml58z0119Do/+7dbVRZOWz3uFoZTb7AFhXR8 vkjv9eQpslvEpVT5Cx1LkGV5s9NYdwYlL+oV+LVCYKQ6u5Pvl8GLi0dc09ri jzaj87EiA8J5QfGHBvBwdEhgmxmzjb10tT9jhQmLUB+sSV9DQuDnemxMn/cp dCmswk406sMoR0M7GLB8Ry3iga8IQs/vy12gm3/j/kirnJl+i7/iBw== =U9HJ -----END PGP SIGNATURE-----