<div dir="auto">Check out pulledpork<div dir="auto"><br></div><div dir="auto"><a href="http://github.com/shirkdog/pulledpork">http://github.com/shirkdog/pulledpork</a></div><div dir="auto"><br></div><div dir="auto">If you find any issues, please log a bug on github.<br><br><div data-smartmail="gmail_signature" dir="auto">--<br>Michael Shirk<br>Daemon Security, Inc.<br><a href="http://www.daemon-security.com">http://www.daemon-security.com</a></div></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Dec 11, 2016 7:51 PM, "James Moe" <<a href="mailto:jimoe@sohnen-moe.com">jimoe@sohnen-moe.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hello,<br>
  linux 4.4.36-5-default x86_64<br>
  oinkmaster v2.0 (2006!)<br>
<br>
  I have been having trouble with Oinkmaster. Namely, it fails to<br>
recognize some of the SIDs; it simply claims there are no such SIDs<br>
("WARNING: attempt to use "modifysid" on non-existent SID 2220006." The<br>
SID defintely exists.). I cannot discover what oinkmaster feels is so<br>
wrong with those particular rules.<br>
  Is there another program that does the same thing as oinkmaster?<br>
<br>
--<br>
James Moe<br>
moe dot james at sohnen-moe dot com<br>
520.743.3936<br>
Think.<br>
<br>
<br>______________________________<wbr>_________________<br>
Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@<wbr>openinfosecfoundation.org</a><br>
Site: <a href="http://suricata-ids.org" rel="noreferrer" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" rel="noreferrer" target="_blank">http://suricata-ids.org/<wbr>support/</a><br>
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" rel="noreferrer" target="_blank">https://lists.<wbr>openinfosecfoundation.org/<wbr>mailman/listinfo/oisf-users</a><br>
Suricata User Conference November 9-11 in Washington, DC: <a href="http://suricon.net" rel="noreferrer" target="_blank">http://suricon.net</a><br></blockquote></div></div>