Security-Onion/securityonion-rule-update — pull request #1 by chriswhitehat (2013-06-14 18:29:20+00:00)
Title: Add sensor specific rule feature

Note: This feature change requires the existence of the UNIVERSAL_RULES=(true|false) variable in /etc/nsm/securityonion.conf

If UNIVERSAL_RULES=true on the sensor in a distributed deployment the behavior remains the same as the current behavior.

If UNIVERSAL_RULES=false on the sensor in a distributed deployment rule update will scp downloaded compressed rules from the master local to the sensor's /tmp dir and then kicks off a local run of pulledpork (with a -n to prevent additional download) allowing for sensor specific enable/disable/drop/etc pulledpork configurations.

To ensure all compressed rules are pulled over it checks the pulledpork.conf for enabled rule_url values, pulls the rule_file portion of the line out and replaces all instances of (.) with (*.) which has no effect for most files but will match any potential VRT rule since Sourcefire includes the snort version in the output file name.