[Snort-sigs] Rant - Rules Organization

Robert Wagner rwagner at ...447...
Fri Apr 26 08:49:52 EDT 2002


Just checked the latest rules to see if the organization/naming had changed.
After spending several minutes tracking down:

INFO FTP anonymous login attempt [Classification: Misc activity] [Priority:
3]: {TCP} 

In the Policy Rule ( Should it say "POLICY FTP anonymous login attempt"?).
I thought I would inquire to see when the naming would start reflecting what
rule it is in.  I understand that I can change this on my own system (thanks
for all of the scripts everyone sent last time), but I was under the
impression that people thought this was a good idea and it might be
incorporated into the general release.  Can anyone speak as to if this
naming convention would be incorporated into the general release?  Possibly
when if is ok?

Thanks in advance for your assistance.  I would gladly help rewrite the
rules if any help is needed.  I think most of them are fine.







More information about the Snort-sigs mailing list