Next: 4.24 How can I
Up: 4 Rules and Alerts
Previous: 4.22 Can Snort trigger
Rules can be called from an included file in snort.conf, which tells Snort to
follow the path to the rules file specified, and load it at initialization.
Rules can also be included in snort.conf directly. If you want to deactivate a
single rule within any list of rules, you can use one of these techniques:
- Delete the rule and re-initialize Snort
- Place a # in front of the rule, commenting it out, and re-initialize Snort
- Write a pass rule with the same properties in local.rules (or wherever you
prefer), and re-initialize Snort with the -o option.
|
