Snort config file locations

manager Thu, 04/25/2019 - 15:04

First edit this file
$ sudo vi /etc/nsm/pulledpork/pulledpork.conf
Locate this line
ignore=deleted.rules,experimental.rules,local.rules
Remove the last part “local.rules”Save and quit the text editor
Run

$ sudo rule-update again.
Check your sguil again and you should see the alerts show up now.

sudo vi /etc/nsm/rules/local.rules
sudo vi /etc/nsm/rules/downloaded.rules 
sudo vi /etc/nsm/pulledpork/pulledpork.conf
sudo vi /etc/nsm/securityonion.conf
sudo rule-update

sudo dhclient -r
sudo dhclient enp0s3
sudo vi david-virtualbox-enp0s3/snort.conf