Unable to ignore ET Pro rulesets

[GoogleCodeExporter]

Made the switch from et open to et pro.  Using PP7.0, command line is here:

/opt/bin/pulledpork.pl -v -l -P -c /opt/etc/snort/pp.conf



ignore=emerging-policy.rules doesn't work

Prepping rules from etpro.rules.tar.gz for work....
        extracting contents of /tmp/etpro.rules.tar.gz...
        Ignoring plaintext rules: emerging-policy.rules
        Extracted: /tha_rules/ET-policy.rules

grep 2012889  ~/snort/rules/rules.rules
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"ET POLICY Http Client Body 
contains pw= in cleartext"; flow:established,to_server; content:"pw="; nocase; 
http_client_body; classtype:policy-violation; sid:2012889; rev:2;)


ignore=ET-policy.rules doesn't work:

Prepping rules from etpro.rules.tar.gz for work....
        extracting contents of /tmp/etpro.rules.tar.gz...
        Ignoring plaintext rules: ET-policy.rules
        Extracted: /tha_rules/ET-policy.rules

grep 2012889  ~/snort/rules/rules.rules
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"ET POLICY Http Client Body 
contains pw= in cleartext"; flow:established,to_server; content:"pw="; nocase; 
http_client_body; classtype:policy-violation; sid:2012889; rev:2;)



ignore=et-policy doesn't work:

Prepping rules from etpro.rules.tar.gz for work....
        extracting contents of /tmp/etpro.rules.tar.gz...
        Ignoring plaintext rules: et-policy.rules
        Extracted: /tha_rules/ET-policy.rules

grep 2012889  ~/snort/rules/rules.rules
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"ET POLICY Http Client Body 
contains pw= in cleartext"; flow:established,to_server; content:"pw="; nocase; 
http_client_body; classtype:policy-violation; sid:2012889; rev:2;)



ignore=policy.rules does:

Prepping rules from etpro.rules.tar.gz for work....
        extracting contents of /tmp/etpro.rules.tar.gz...
        Ignoring plaintext rules: policy.rules

grep 2012889  ~/snort/rules/rules.rules

This however nukes the VRT-policy.rules:

Prepping rules from snortrules-snapshot-2970.tar.gz for work....
        extracting contents of /tmp/snortrules-snapshot-2970.tar.gz...
        Ignoring plaintext rules: policy.rules

How does one manage to do this with PP?  Thank you.

Original issue reported on code.google.com by [email protected] on 17 Feb 2015 at 5:46

[shirkdog]

I now have the ability to test all rulesets, it appears ignoring is not currently working for anything. This will be the use-case for how things should be working.

[shirkdog]

For now, moving this to 0.7.3, as this will take longer to resolve.