[Snort-sigs] RE: Signature Database

Brian bmc at ...95...
Tue Apr 27 11:16:06 EDT 2004


On Tue, Apr 27, 2004 at 11:47:53AM -0500, Matt Jonkman wrote:
> Some sort of a moderator based signature submission setup. Users can
> submit sigs, they go to a board of 'moderators'. These volunteer
> moderators (not snort.org people as their focus is and should be on
> coding) verify the sig is good, accurate, and compatible with whatever
> release they agree to service.

We have tried that already.  It doesn't work as well as you might
think.

I used to include experimental signatures (see experimental.rules
history in the CVS tree) but after getting tons of negative responses,
I stopped doing that.

Now, users send them to snort-sigs.  Read the mailing list or the
archives if need be.  Otherwise, check the archives.  MARC is AWESOME.
Use it.
    
    http://marc.theaimsgroup.com/?l=snort-sigs

Brian




More information about the Snort-sigs mailing list