ips_policy applying to local_rules

[dougburks]

Hello!

This question is related to https://github.com/shirkdog/pulledpork/issues/235.

Since the current version of PulledPork now copies rules from local_rules to rule_path, it looks like if you set an ips_policy to apply to your Snort ruleset, it will try to apply that policy to your local_rules as well. Since most local rules don't have any policy set, they are therefore disabled. For example, please see: https://groups.google.com/d/topic/security-onion/D9BW2ttPF3Y/discussion

Is this intended behavior?

[shirkdog]

In the case you referenced, I would assume this is not intended behavior, because the engine is Suricata and not Snort, but still seems like worth investigating even for Suricata.

But having the ability to have policy in your local.rules outside of the official Talos rules for Snort sounds like something you would want, I will take a look and let you know.