Quantalytics / pulledpork

Automatically exported from code.google.com/p/pulledpork
GNU General Public License v2.0
0 stars 0 forks source link

PulledPork not loading/merging the local_rules #86

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago
What steps will reproduce the problem?
1. point local_rules to your local.rules complete path in the pulledpork.conf
2. run pulledpork -c pulledpork.conf -o /etc/snort/rules/snort.rules
3. the big snort.rules file is created with all the ET rules, but no rule from 
local.rules is inserted

What is the expected output? What do you see instead?

I was expecting PP to "merge" the ET rules downloaded with the local.rules 
(specified with local_rules in the cfg file) into the snort.rules file.

I do not see any rule from local.rules in snort.rules

What version of the product are you using? On what operating system?
v0.6.1. RHEL 6.1 32-bit

Please provide any additional information below.

Original issue reported on code.google.com by SanchezMartin.JI@gmail.com on 7 Jul 2011 at 4:58

GoogleCodeExporter commented 9 years ago
This is expected behavior.  The purpose of the include option is to include the 
meta for those rules in the sid-msg.map.  I'm going to close this for now, if 
you want these rules included in the master rules file, please post another 
comment and I'll change this to a feature request.

Original comment by Cummin...@gmail.com on 11 Jul 2011 at 5:42

GoogleCodeExporter commented 9 years ago
Ok I understand. 

I think including the local rules into the master rules file could be an useful 
feature. 

Original comment by SanchezMartin.JI@gmail.com on 11 Jul 2011 at 8:33