New to PulledPork- Dealing with SO_RULE

[scowles]

I have completed installing and configuring for PulledPork.  Now I see all of these SO_RULES in the snort.conf file.  They are all commented out.  I am not catching any events.

I see no other rules in snort.conf other than SO_RULEs.  Are there supposed to be regular rules there?  If yes, how do I get them there?

I have started to read-

SO_Rules are not compatible with Windows.

Edited June 5, 2015 by scowles
Clarification

[Morpheus]

All the riles are now compiled into a single winids.rules file. If you are not catching events then there are a few reasons why.

1) HOME_NET is not set correctly

2) The '-ix' switch in the run line is pointing to the wrong interface

3) The Windows Intrusion Detection System is plugged into a switch that either is not capable of mirroring. or mirroring is not setup.