Re: [Snort-users] threshold -- is it really deprecated?

[Rich Graves <rgraves () carleton edu>]

You're all talking like there's a difference between rules files and threshold.conf. There isn't.

Why don't you put detection_filter and event_filter directives in your .rules files, right after the rule? PulledPork 
and the like would have to pass them through unmolested (untested), but this seems the simplest solution to me.

------------------------------------------------------------------------------
Keep Your Developer Skills Current with LearnDevNow!
The most comprehensive online learning library for Microsoft developers
is just $99.99! Visual Studio, SharePoint, SQL - plus HTML5, CSS3, MVC3,
Metro Style Apps, more. Free future releases when you subscribe now!
http://p.sf.net/sfu/learndevnow-d2d
_______________________________________________
Snort-devel mailing list
Snort-devel () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-devel

Please visit http://blog.snort.org for the latest news about Snort!