[Snort-users] Reliability of signatures

Martin Holste mcholste at ...11827...
Fri Feb 4 11:39:07 EST 2011


> Vendor sponsored projects are okay I think, especially since we have the
> resources to donate to a project that is going to make everyone's detection
> better.
>

LOL says the vendor...  Seriously though, I guess I'd be ok with SF
hosting as long as they agreed to be source-agnostic and were very
clear about how the whole thing works.

> What I was thinking was having a reputation (hit) count score from gid:sid
> and maybe from the IP involved, then allow people to comment on said results
> manually.

Right, but what is the mechanism for the auto reporting, that is,
what's the criteria?




More information about the Snort-users mailing list