# Default to no PulledPork options
        PP_OPTIONS=""

        # OPTION: -n if we have no Internet connection
        if [ "$LOCAL_NIDS_RULE_TUNING" == "true" ] || [ "$LOCAL_NIDS_RULE_TUNING" == "yes" ]; then
                cp /opt/emergingthreats/emerging* /tmp
                PP_OPTIONS="-n"
                echo "LOCAL_NIDS_RULE_TUNING is enabled."
                echo "This will cause PulledPork to use the existing rules in /opt/emergingthreats/"
                echo "instead of downloading new rules from the Internet."
                echo "If you want PulledPork to download new rules from the Internet,"
                echo "set the following in /etc/nsm/securityonion.conf:"
                echo "LOCAL_NIDS_RULE_TUNING=no" 
        fi

        # OPTION: -T if the user is running Suricata
        if [ "$ENGINE" = "suricata" ]; then
                PP_OPTIONS="$PP_OPTIONS -T"
                echo "ENGINE=suricata, so we'll execute PulledPork with the -T option to avoid adding soid rules to downloaded.rules."
        fi

        # Go get rules from Internet.
        echo "Running PulledPork."
        /usr/bin/pulledpork.pl -P $PP_OPTIONS -c /etc/nsm/pulledpork/pulledpork.conf |
                grep -v "normalizations disabled because not inline" |grep -v "^$"

Submitted for testing:
https://groups.google.com/d/topic/security-onion-testing/RoNGrHjMEGk/discussion

Published:
http://blog.securityonion.net/2014/07/new-securityonion-rule-update-package.html