Re: Editing ISS RealSecure Network Sensor policy from commandline

[ismail syed <ismail_syed05 () yahoo com>]

 This is what I exactly want to know, here I want to
add one more thing is there a way to check and select
the signatures of new XPU before pushing them to the
sensor policy, so that we don't have to open the
policy  
of each individual sensor for checking new XPU
signatures, it will ease the task if we have 100s of
sensors to update.

Any suggestion please.

Thanks
Ismail

--- Jim <gunmetalx () gmail com> wrote:

> Is there any way to edit the Network Sensor (version
> 7) policy with a text
> editor, and reliably apply this policy?
>
> I work for a fairly large MSP and some of our
> customers require event filters to
> be added in large numbers. Adding these
> one-at-a-time in the Policy Editor is
> VERY painful.  For example, one customer yesterday
> requested that 10 source IPs
> ignore 9 signatures when talking to 2 destination
> IPs.  I would go insane if I
> had to add 180 individual entries by hand.
>
> I found the "current.policy" file on the sensor
> itself, but it seems that
> changes to this file are not visible in the
> console's Policy Editor.  For
> example, if I edit one of the filters in
> current.policy and then "Edit Current
> Policy" from the Site Protector console, the changes
> are not there.  This is the
> case no matter whether I stop the sensor/daemon from
> the OS shell or using
> Stop/Start in Site Protector.
>
> Please let me know if there's any way to do this! 
> I've scoured Google for about
> 2 days now, and a couple other employees here have
> asked ISS for help with this
> and have gotten nowhere.
>
> Thanks very much.
------------------------------------------------------------------------
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it 
> with real-world attacks from CORE IMPACT.
> Go to
http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
> to learn more.
------------------------------------------------------------------------
>


__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
------------------------------------------------------------------------