Morpheus,
After adding the PulledPork add-on events have stopped. I went back thru my snort conf file following the update tutorial and the only discrepancies I found had to do with the preproc_rule paths. In the update tutorial, the rules are turned on, in the PulledPork tutorial, they are turned off. Once I turned them back on, events started spooling to the unified2 file consistently. Which is the correct configuration?
2 replies
Important Information
We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.