Re: [Snort-devel] [Emerging-Sigs] New Proposed Classification.config file setup

[onelson <onelson () gmail com>]

Sorry I'm coming to this thread a bit late. I'm going to have to take a 
minute to pick through all that's been posted here, but I just wanted to say 
that in the short
time I've been working with snort, the thing that's struck me as a pain are 
the events with sigs that aren't classified at all. Maybe this is not the 
role of the engine itself, 
but I'd almost like to see snort refuse to load rules that match sigs that 
are missing a class.

I love the idea of using tags (many to many) rather than a straight sig 
class (one to many), but in the case of illustrating protocols/services in 
play for 
the sig I'd say the data is already there. It should be up to the log viewer 
or analyst to query for ports, etc.

Also, integers ftw! I'd love it if the ids for these new class/tag records 
could be defined up front, but I guess that's one of those things.

Regards,
Owen Nelson

------------------------------------------------------------------------------
Enable your software for Intel(R) Active Management Technology to meet the
growing manageability and security demands of your customers. Businesses
are taking advantage of Intel(R) vPro (TM) technology - will your software 
be a part of the solution? Download the Intel(R) Manageability Checker 
today! http://p.sf.net/sfu/intel-dev2devmar

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users