New Goner.A worm signatures

[suzanne.nichol]

I have updated two of our sensors with the goner.a custom signatures, but now the custom filters on these sensors have disappeared.

I have to regress the sensors to a previous IDS configuration to get the filters back, but that configuration hasn't got the Goner.A signatures. Typical!

Have I done something wrong?

[marcabal]

I believe you have found a bug in the interoperability of the Unix Director with SigWizMenu.

We just found out about it this afternoon, and we haven't had a chance to notify everyone about it yet.

If you are creating filters with the Unix Director and then run SigWizMenu, the filters will be removed.

Workaround:

To prevent this from happening, do not use SigWizMenu. Instead nrConfigure on the Unix Director should be used to create the Custom Signatures. nrConfigure has all the functionality available in the SigWizMenu program so you should use nrConfigure instead of SigWizMenu to keep from seeing this problem.