1

I am working with snort. I have included both latest community and registered rules in my snort configuration file. During run time I found many rules have duplicated, that is some rules available in both community and registered rules. Thus my snort ignoring old duplicated rules.Because of this snort takes much time to come up. How to ignore these duplication ? or shall I include registered rules only in my snort? . Is all snort community rules available in snort registered rules ?

4

Is all snort community rules available in snort registered rules ?

Yes. snort Registered ruleset contains the Community ruleset. Ref

or shall I include registered rules only in my snort?

It is recommended that you use both the Registered Ruleset and the community ruleset, if you are not going to become a subscriber. Ref

  • 1
    rootkea is right. Source: I am in charge of the rule sets and the website. – Joel Esler Oct 14 '16 at 23:24
  • 1
    If registered rulesets contain all community rules then why is it recommended to use both? It increases the running time of snort to remove duplicate rules. – Lakshmi Balan Oct 15 '16 at 8:52
  • 1
    @JoelEsler can answer it better about the recommendation of using both the Community Ruleset and Registered Ruleset even though snort Registered ruleset contains the Community ruleset. – rootkea Oct 19 '16 at 9:48
  • Any info on @LakshmiBalan's question? – Gabriel Rebello Apr 23 '18 at 17:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.