[Snort-sigs] Re: "bad guy" tagging

Brian bmc at ...95...
Thu Jul 17 18:31:19 EDT 2003


On Thu, Jul 17, 2003 at 12:15:37PM +0200, Martin Olsson wrote:
> Ok, it might not be the most beautiful solution, but putting this standard
> word first in the msg-tag works.
> 
> When can we expect an official anouncement?

Since when has a decision been made?  

Snort has a meta-data stored in keywords.  References are a perfect example
of meta-data that is handled in a keyword.  Those that want to use the
meta-data can.  Those that don't, don't.

Requiring parsing of messages for applications that want the support
is a nasty hack that I'd love to avoid.

-brian




More information about the Snort-sigs mailing list