Updating snort rules automatically

Question

I've been working on getting my snort machine up and running, and working through Snort IDS and IPS Toolkit.

The authors suggest using Oinkmaster, but on that website, the last update was February of 2008. That seems sort of...odd. Maybe there haven't been any issues with oinkmaster in the past year and a half, but it made me wonder if there was another solution that I don't know about.

If you use snort, do you automatically update your rules, and if so, how?

Even though oinkmaster hasn't been updated in a long time, it is such a simple program that it doesn't need constant updates. — Scott Pack, Nov 16 '09 at 16:43

score 3 · Answer 1 · answered Oct 28 '09 at 12:41

3

Oinkmaster is the recommended and best way to keep your rules updated. It is a simple script that's why it hasn't been updated in a while.

This is a good howto: http://taosecurity.blogspot.com/2004/07/using-oinkmaster-to-update-snort-rules.html

answered Oct 28 '09 at 12:41

sucuri

2,817
1
22
22

score 2 · Accepted Answer · answered Dec 22 '10 at 16:35

Pulled Pork is now considered the recommended rule updating system for Snort. While it is not an official Sourcefire product, it is developed by a Sourcefire employee.

The syntax is slightly more complicated than oinkmaster, however a contributed script, oink-conv.pl, will read in your oinkmaster config and convert it to pulledpork syntax making system conversions much easier.

In addition to update standard rules, it is also capable of managing the so_rules that were previously a manual process.

Updating snort rules automatically

2 Answers2