dsabecky / securityonion_utilities Goto Github PK

Currently the only rules that can be updated via the utility are the local.rules. A submenu should be added in place of the local.rules option that would list all enabled (via snort.conf) rules files for editing.

Add ability to cancel/go back to main menu from a sub option.

eg: change password, press Q to return to main menu.

Should append to previous. An issue that will arise is filesize, which should be either split into an old log or deleted.

Move settings to separate config file to prevent overwriting every time script is updated.

Option to pull/parse approriate files and stats from system for an outside entity to gather system health.

When utilizing the config editor options, a backup is created in /var/log/nsm, however they are never pruned. Add option to remove files after configured date (or pulledpork date if available).

pulledpork requires LOCAL_NIDS_RULE_TUNING to equal "yes" vice "YES" in older versions.

When applying updated signatures via rule update, if Snort fails to properly restart (status text states review log for error) then offer to open that particular log either before or after offering the rule_changes.log

When returning to the main menu from a submenu, artifacts are leftover and not properly cleared.

Merge number with letter.