CapturePacket Default Settings

[ThorsonMacAoidh]

I have a custom RDEP based system that pulls the event logs from my IDS systems. I have found that the CapturePacket(=True) feature is great for getting high quality information from my event logs.

Is there a way to globally change the signature settings so that each sig will have this option set to True (instead of the default of False)? Is there a way to change the default value for this option on a sensor?

TM

[marcabal]

There is no way to change the default option on the sensor or globally.

Each sensor will have to be individually edited.

If using IDM or CLI for configuration a faster method will be to execute "show conf" on the sensor and copy all of the signature configuration lines to a text edit window.

The "show conf" output has a section in it for every signature.

You can then paste in the line for turning on capture packet into the configuration area for each signature in your text edit window.

Then copy all of the configs from the text window and paste it into a CLI.

This is kind of a faster way of doing the config through the CLI.

The ability to add actions to multiple signatures is in our enhancement list for future versions.

[ThorsonMacAoidh]

OK,

This will work for now.

Are there any signatures that will cause problems to enable CapturePacket. IOW, are there any known issues with enabling CapturePacket on all signatures?

Thanks,

TM