We have been using the snort parsing in our environment with great
success but one issue we are running into is the volume of rules we have
running is clogging up our risk.info category. While we're working
through some tuning, one of my analysts wan...
I'd like to bump this thread as we are looking at more and more json
formatted feeds both from api calls to SA's web interface we'd like to
turn back into feeds or other $vendor threat intel feeds published in
json. So far I have only seen the custom...
They are definitely a bit noisy but some minor modifications can tighten
this up to actual events. Currently the app rule client begins '() {
:;};' && service !=25 is one of our better indicators. Feedback on the
parser - it's been a while since I ha...
The app rule is ok but we're finding it is also triggering on emails
back and forth about shellshock. I modified yours to exclude email
alias.host begins '()' || referer begins '()' || client begins '()' &&
service !=25 and we have also been using th...
This is some pretty cool stuff. How easy would it be to do additional
modifications to see device performance over time as well? For example -
my hybrid is a busy little box. I would love to trend its activity over
a 24 hour period to see how it is b...
