I'm using SecurityOnion distro and I would to run snort on my pcap files. Is there a way to specify just one rule? I couldn't understand whether
local.rules is used.
How can I show only the result of my rules instead of standard output?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Are you trying to have Snort display only the result of your own custom rules created in local.rules?
Why not create one such as an example below in local.rules, move all the other existing rules to someplace else leaving only the local.rules for testing? That way, only your local.rules will be checked against.
alert tcp any any -> any any (msg:"Testing TCP"; sid:10002)
When you run Snort in IDS mode, it will show up below alerts whenever there is any TCP traffic is happening.
Hope this helps.