pulledpork for Mac

PulledPork for Snort and Suricata rule management (from Google code)

Find us on Libera.Chat (IRC) #pulledpork

Copyright (C) 2009-2021 JJ Cummings, Michael Shirk and the PulledPork Team!

Thank you for choosing to use PulledPork! This file provides some basic guidance on the usage of PulledPork. Please be sure to read this file thoroughly so that you don't overlook something!

Features and Capabilities

Automated downloading, parsing, state modification and rule modification for all of your snort rulesets. Checksum verification for all major rule downloads Automatic generation of updated sid-msg.map file Capability to include your local.rules in sid-msg.map file Capability to pull rules tarballs from custom urls Complete Shared Object support Complete IP Reputation List support Capability to download multiple disparate rulesets at once Maintains accurate changelog Capability to HUP processes after rules download and process Aids in tuning of rulesets Verbose output so that you know EXACTLY what is happening Minimal Perl Module dependencies Support for Suricata, and ETOpen/ETPro rulesets A sweet smokey flavor throughout the pork!

Command Usage Reference

Basic Usage Examples

A simple example of how to use PulledPork would be to specify all of your configuration directives inside of the PulledPork.conf file. Specifically for minimal function, i.e. NO Shared Object rule processing you must define at a minimum the rule_file, oinkcode, temp_path, tar_path, and rule_path values. Below are some examples of this.

The above will fetch the snortrules-snapshot-2973.tar.gz tarball from snort.org using the specified oinkcode of 12345667778523452344234234 and put the rules files from that tarball into the output path of /usr/local/etc/snort/rules/ while the -i option tells pulledpork where the disablesid.conf lives, and the -T option tells pulledpork to not process for any shared object rules and the final -H option tells pulledpork to send a Hangup signal to the snort pid that you defined in the pulledpork.conf.

Similar to the first example but all options specified in the pulledpork.conf file (other than disablesid and -H)...

The above will simply read the disablesid and disable as defined, then send a Hangup signal after generating the sid-msg.map at the specified location without downloading anything. Highly useful when tuning / making changes etc..

Next example, snort inline with rules that we want to drop and disable, then HUP our daemons after creating a sid-msg.map and writing change info to sid_changes.log!

Next example, same as the previous but specifying that we want to run the default "security" based ruleset and that we want to enable rules specified in enablesid.conf.

Next example, same as the previous but specifying that we want to -K (Keep) the originationg tarball names. and write them to /usr/local/etc/snort/rules/