Re: [security-onion] Re: How to threshold pre-thresholded rules?

[Doug Burks]

Hi Gcracker,

You're correct in that you shouldn't manually modify downloaded.rules
since any changes will be overwritten the next time PulledPork runs.

Have you considered using PulledPork's modifysid.conf to modify the
threshold in the rule?

Hope that helps!

Thanks,
Doug

On Thu, May 9, 2013 at 12:57 PM, Gcracker <graham....@gmail.com> wrote:
> Apologies. the 2nd to last sentence should read: "...downloaded.rules file changes when "rule-update" is run..."
>
> --
> You received this message because you are subscribed to the Google Groups "security-onion" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to security-onio...@googlegroups.com.
> To post to this group, send email to securit...@googlegroups.com.
> Visit this group at http://groups.google.com/group/security-onion?hl=en-US.
> For more options, visit https://groups.google.com/groups/opt_out.
>
>



--
Doug Burks
http://securityonion.blogspot.com