Re: [Snort-sigs] Comments for rules

On Tue, 2005-05-24 at 10:25 +-0100, Jo+AOM-o Mota wrote:
+AD4 Matt Jonkman wrote:
+AD4 
+AD4 +AD4 It is definitely on our future goals. A method where you can easily 
+AD4 +AD4 get to the docs of a particular sig by hitting
+AD4 +AD4
+AD4 +AD4 www.bleedingsnort.com/docs.php?sid+AD0-2000000
+AD4 
+AD4 I don't think that creating a dinamic page/site is totally necessary. 

once you have the information stored and maintained (that is the big
job) making it available dynamically via the web is trivially (by
comparison anyway) easy and it makes a big difference to the utility of
the info.  

I don't see aiming for this as slowing down the delivery of the docs.
In fact if it came to the stage where BS had the docs I'd happily
volunteer to write a simple web based search app.

While on the topic of documentation, I'm afraid that in this case the
best (and possibly the only) person to write it is the person who wrote
the original rule.  I consider myself reasonably up with the network
forensics scene and yet often look at rules that others have written and
have been unsure exactly what they are trying to achieve, particularly
when the message is cryptic.  I believe that all rule submissions should
have at least an extended sentence or a short paragraph explaining what
the rule is intended to do and some explicit reference to the threat it
is trying to detect (CVE etc or link to other source). 

Russell

smime.p7s
Description: S/MIME cryptographic signature