[Snort-sigs] Re: "bad guy" tagging
bmc at ...95...
Thu Jul 17 18:31:19 EDT 2003
On Thu, Jul 17, 2003 at 12:15:37PM +0200, Martin Olsson wrote:
> Ok, it might not be the most beautiful solution, but putting this standard
> word first in the msg-tag works.
> When can we expect an official anouncement?
Since when has a decision been made?
Snort has a meta-data stored in keywords. References are a perfect example
of meta-data that is handled in a keyword. Those that want to use the
meta-data can. Those that don't, don't.
Requiring parsing of messages for applications that want the support
is a nasty hack that I'd love to avoid.
More information about the Snort-sigs