Project

General

Profile

Actions
Copy link

Optimization #1873

closed

Classtypes missing on decoder-events,files, and stream-events

Added by Jack Mott about 8 years ago. Updated over 7 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Andreas Herz
Target version:
4.0beta1
Effort:
Difficulty:
Label:

Description

Hi,

These rules do not have an associated classtype with them. Could you take a look and determine if that would be a relevant addition?

Best,

Jack

Actions
Copy link
 #1

Updated by Andreas Herz about 8 years ago

  • Tracker changed from Bug to Optimization
  • Assignee set to OISF Dev
  • Target version set to TBD

stream-events has classtype, do you have anything special in mind?

Actions
Copy link
 #2

Updated by Andreas Herz over 7 years ago

We have some shipped rules with classtypes and some without:

(classtype:protocol-command-decode)
  • app-layer-events.rules
  • http-events.rules
  • smtp-events.rules
  • stream-events.rules
  • tls-events.rules
(no classtype)
  • decoder-events.rules
  • dnp3-events.rules
  • dns-events.rules
  • files.rules
  • modbus-events.rules

Something we just forgot or is that for a specific reason?

Actions
Copy link
 #3

Updated by Victor Julien over 7 years ago

Seems it was forgotten. Btw the files.rules file is really only meant to be an example.

Actions
Copy link
 #4

Updated by Andreas Herz over 7 years ago

Yep that's also why the rules in there are commented, so would it be ok to add the classtype:protocol-command-decode to the 4 rule files left?

Actions
Copy link
 #5

Updated by Andreas Herz over 7 years ago

  • Assignee changed from OISF Dev to Andreas Herz
Actions
Copy link
 #6

Updated by Victor Julien over 7 years ago

  • Status changed from New to Closed
  • Target version changed from TBD to 4.0beta1
Actions
Copy link

Also available in: Atom PDF