2

I am working with snort. I have included both latest community and registered rules in my snort configuration file. During run time I found many rules have duplicated, that is some rules available in both community and registered rules. Thus my snort ignoring old duplicated rules.Because of this snort takes much time to come up. How to ignore these duplication ? or shall I include registered rules only in my snort? . Is all snort community rules available in snort registered rules ?

Improve this question

1 Answer 1

Reset to default
5

Is all snort community rules available in snort registered rules ?

Yes. snort Registered ruleset contains the Community ruleset. Ref

or shall I include registered rules only in my snort?

It is recommended that you use both the Registered Ruleset and the community ruleset, if you are not going to become a subscriber. Ref

Improve this answer
4
  • 1
    rootkea is right. Source: I am in charge of the rule sets and the website.
    – Joel Esler
    Commented Oct 14, 2016 at 23:24
  • 2
    If registered rulesets contain all community rules then why is it recommended to use both? It increases the running time of snort to remove duplicate rules.
    – Lakshmi Balan
    Commented Oct 15, 2016 at 8:52
  • 1
    @JoelEsler can answer it better about the recommendation of using both the Community Ruleset and Registered Ruleset even though snort Registered ruleset contains the Community ruleset.
    – rootkea
    Commented Oct 19, 2016 at 9:48
  • 1
    Any info on @LakshmiBalan's question?
    – Gabriel Rebello
    Commented Apr 23, 2018 at 17:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .