Problem with SID Management in Snort

Simbad · Sep 8, 2019, 7:53 AM

Has anyone ever encountered a problem using SID Management that some of the rules are not "properly" enabled?

I help myself through SID Management by turning on enablesid-sample.conf

with the following rules:

What am I doing wrong?

Simbad · Sep 8, 2019, 7:56 AM

bmeeks · Sep 9, 2019, 2:12 AM

I'm quite confused by the four different enablesid-sample.conf file screencaps you posted. Are those all in the same file, or did you actually post four different versions?

The SID MGMT logic is not meant to work the way you are doing it. It is not designed to enable every single rule in every category. It's never been tested for that -- might work, or might not.

Why are you doing this anyway? That most definitely is not the correct way to configure an IDS.