diff --git a/install.pl b/install.pl index 53968d4..04fc817 100755 --- a/install.pl +++ b/install.pl @@ -810,6 +810,7 @@ () if (/^\s*(\S+)\s+(.*?)\;/) { my $varname = $1; my $val = $2; + next if $varname eq 'IP_INFO'; if ($val =~ m|/.+| and $varname =~ /^\s*(\S+)Cmd$/) { ### found a command $cmds{$1} = $val; diff --git a/psad.conf b/psad.conf index 3e96cd9..7a98c00 100644 --- a/psad.conf +++ b/psad.conf @@ -210,7 +210,7 @@ REPUTATION_FEED "EmergingThreats Compromised IPs",4,IP,newline,1440, ### in the URL will be substituted with the actual source IP for each ### detect scan. ENABLE_IP_INFO_URL Y; -IP_INFO "Talos Intelligence",https://www.talosintelligence.com/reputation_center/lookup?search=$SRC +IP_INFO "Talos Intelligence",https://www.talosintelligence.com/reputation_center/lookup?search=$SRC; ### When enabled, this instructs psad to write the "msg" field ### associated with Snort rule matches to syslog.