@bmeeks said in SID Mgmt change drop to block (white listing instead of blacklisting):
Yes, it's a bit of typing or copy-paste, but that's part of the drudgery of what an IDS/IPS admin does. Once done, it's done.
And that's what I ended up doing, listing all the 50+ ET rules lists, except the three I wanted to keep as Alert only. Which, in order to keep track of what I did, I commented out and kept in the file.
But once done, it's done isn't really true is it? Things change, and you constantly need to adjust, typically by disabling or suppressing rules that are false positives. Mostly individual rules, but it could possibly be an entire list.
I think all changes I have ended up making are in the direction from Drop to Alert. Not the other way around... Starting out from some reasonable level based on e.g. Snort Policy (where I use Balanced) and some ideas about what other rules lists to disable or keep as Alert.
And this is part of what is so good with the lists, also the suppress list, in that they are so simple to read, and can easily be copied over to other tools like excel. They give you a good overview of what it is you have done.
And then we have usability aspect, and being practical or efficient. It's either:
emerging-3coresec.rules
emerging-activex.rules
emerging-adware_pup.rules
... and so on for each list ...
Or simply writing.
emerging
And then all the emerging threats rules are affected, and changed to Drop for example.
Then the next simple step would be to have a few of them reverted back to Alert, by creating a list for that, as suggested.
