Monday, December 12, 2011

SNORT Sig updates Including SED

Whenever I update Snort Rules, the five SID mentioned below gets additional ! before $DNS server which makes SNORT not to start.  All these SID are included inside emerging-current_events.rules.


so as a work around I have included sed "Serial Editor" along with my snort rules update script as shown below.

root@Bodhidarmar:/store/snort/rules# cat /var/scripts/

wget -q -O /store/snort/archive/snortrules-snapshot-xxxx.tar.gz -o /store/snort/rules/ -Q
echo "Now Running Serial Edit to change the Bang Dollar DNS to Dollar DNS in ET-current_event[DOT]rules"
sed s/\!\$DNS/$DNS/ /store/snort/rules/emerging-current_events.rules > /store/snort/rules/emerging-current_events.rules

Note I have reduced the Font size above as they needs to be on one single line.

No comments:

Post a Comment