Re: [Snort-sigs] OSSRC Rules Overlap Committee

Blake Hartstein wrote:
> Dear Current or Future Committee Members,
> As a possible solution to this problem, I think it would be reasonable
> to allow a 'vendor' keyword in the sid keyword. Take the following as
> an example,
> FORMAT sid:vendor,value;
>
> sid:vrt,1234;
> sid:bleeding,1234; 
The schema is already a bit crowded with generator-id, sig-id,
classification-id, and revision.

Your suggestion would work if we just asigned 'registered'
vendors/organizations a numeric range of existing sid values.  That
would suffice for now.  If the snort parser/oinkmaster/barnyard and
other tools want to adjust their interfaces to handle the 'vendor/sid'
translation to 'effective-sid' then fine, but it's not necessary.

Jeff


-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs