ET Pro Rules Oink Codes #9995
-
|
Hello! According to Proofpoint, I need seperate Oink Codes per sensor. How to I configure these different Oink Codes? The SO documentation describes only the general activation of the Pro Rules with one Oink Code here. Thanks in advance! Cheers, Ben |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 1 reply
-
|
Proofpoint may require a separate license per sensor, but the oink code is only used on the Manager -- the Manager pulls down the ruleset, makes any tuning changes that you've configured using idstools, adds any local rules you've put in local.rules, and then uses Salt to push the final rule set out to the sensors. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks! |
Beta Was this translation helpful? Give feedback.
Proofpoint may require a separate license per sensor, but the oink code is only used on the Manager -- the Manager pulls down the ruleset, makes any tuning changes that you've configured using idstools, adds any local rules you've put in local.rules, and then uses Salt to push the final rule set out to the sensors.