Re: DB Rules

[Mike Baptiste <mike () baptistefamily net>]

I don't think having Snort refer to rules in a central DB in realtime is 
a good idea.  Central point of failure, etc, etc.  Like many have 
already posted.

That said, I'm currently working on a DB setup which will store lots of 
info about Snort rules includign user comments, ideas, etc. and will 
have interfaces for user to grab rules manually or automatically as they 
are added, changed, etc so you can automate rules updates (to a point) 
So rules would still be stored locally, but you'd be able to pull in new 
rules and stuff from teh DB>  Users can also submit their own rules and 
create rule profiles for various situations, setups, etc.

The DB itself is done including the code to take rule files and import 
them into the DB as new changes come out (so I can download hte snort 
rules and update the DB anytime a new rule set comes out in CVS) and I'm 
currently working on user profile stuff.  I'm also working on an 
addition to my Snort Webmin Module (http://www.msbnetworks.com/snort/) 
which will let you grab new/changed rules from my DB and splice them 
into your existing rule files.

I'll post more info as things move along.  Perhaps by teh end of next week.

Mike

Charles Henrich wrote:
> It would be really cool if snort could read its rulesets from the database
> source.  That way remote sensors who are talking directly to the central DB
> server could get immediate rule updates, and make administration of a snort
> network much easier.. (IMHO).  Whacha think?
>
>       Charles Henrich                                     henrich () sigbus com
>
>                          http://www.sigbus.com/~henrich
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users



_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users