[Snort-sigs] OSSRC Rules Overlap Committee

Blake Hartstein bhartstein at ...274...
Tue Jan 31 17:20:02 EST 2006


Dear Current or Future Committee Members,
As a possible solution to this problem, I think it would be reasonable 
to allow a 'vendor' keyword in the sid keyword. Take the following as an 
example,
FORMAT sid:vendor,value;

sid:vrt,1234;
sid:bleeding,1234;

Of course the default options could still be allowed, but this would 
certainly solve the problems of allowing multiple people to 
independently manage their own sids.
sid:1234;

Then once that is done, we would just need to create the 'Vendor Naming 
Committee'...
What do you think?

-Blake




Jennifer Steffens wrote:

> The Open Source Snort Rules Consortium (OSSRC) is seeking several 
> qualified individuals to head up our first committee. This committee 
> will be chartered with defining a method to identify and either 
> prevent or help users understand the overlap and differences between 
> similar rules in the open source Snort rulesets.
>
> These individuals should have better than average understanding of Snort
> rules. The most likely candidates will be those that work in the
> industry and with Snort on a regular basis.
>
> We anticipate this role will take a number of hours commitment up front
> to define the process and method, but long term will likely not be a
> significant load.
>
> Please email ossrc at ...95... with questions or to be considered for 
> this committee.
>
> Cheers,
> Jennifer
>
>


-- 
This email and any files transmitted with it are solely intended for the use of the addressee(s) and may contain information that is confidential and privileged.  If you receive this email in error, please advise us by return email immediately. Please also disregard the contents of the email, delete it and destroy any copies immediately.  Demarc Security, Inc. does not accept liability for the views expressed in the email or for the consequences of any computer viruses that may be transmitted with this email.

This email is also subject to copyright. No part of it should be reproduced, adapted or transmitted without the written consent of the copyright owner.





More information about the Snort-sigs mailing list