216

Chapter 7     Miscellaneous Tools

On the left hand side of the window shown in Figure 7 5 is a list of different

classes of rules used on the sensor. The right hand side of the window shows a descrip 

tion of the class and individual rules included in that class. To modify a rule, you can

double click that rule and a window like the one shown in Figure 7 6 will appear where

you can modify different parts of a rule.

The pull down menus in the right side of the window shown in Figure 7 6 make it

very easy to modify rules. For example, to modify protocol used in the rule, you can

click the pull down menu button and a list of supported protocols will appear.

To modify other parts of the 

snort.conf

 file, you can click the  Settings  tab

on the top left side of the window. A window like the one shown in Figure 7 7 appears

where you can modify input and output plug ins and values of different variables.   

As you can see in the screen shot in Figure 7 7, the database user name and pass 

words are displayed. These are the same ones we used in Chapter 5 while configuring

the MySQL database.

After making changes to the policy, you can close this window. Now you can

upload it to the sensor using options in the  Sensor  menu of the main menu.

IDS Policy Manager makes it very easy to modify sensor policies. It does almost

all of the tasks that are discussed in Chapter 3 and Chapter 4.   

Figure 7 6 

Modifying a rule in IDS Policy Manager.