Project

General

Profile

Actions

Feature #535

open

new keywords - time , day

Added by Peter Manev about 9 years ago. Updated about 2 years ago.

Status:
New
Priority:
Normal
Target version:
Effort:
low
Difficulty:
low
Label:

Description

It would be beneficial if we introduce "time" and "day" keywords.

ex:

alert ip any any-> any any (msg:"Time and Day based alert "; content:"login failed"; time:12.23,>,15.30; day:Saturday,Sunday;)
alert if this is between 12:23 and 15:30 on a Sunday or Saturday

the same idea here:
alert ip any any-> any any (msg:"Time and Day based alert "; content:"login failed"; day:Saturday,Sunday;)
alert ip any any-> any any (msg:"Time and Day based alert "; content:"login failed"; time:12.23,>,15.30; )

also very important:
alert ip any any-> any any (msg:"Time and Day based alert "; content:"login failed"; time:12.23,>,15.30,packet; day:Saturday,Sunday;)
where time:12.23,>,15.30,packet; is the time of the packet

and
alert ip any any-> any any (msg:"Time and Day based alert "; content:"login failed"; time:12.23,>,15.30,OS; day:Saturday,Sunday;)
where time:12.23,>,15.30,OS; is the current time of the OS

pros?
cons?

Actions #1

Updated by Eric Leblond about 9 years ago

Just thinking to that: Need to be able to treat the timezone with respect to source or destination IP ...

Actions #2

Updated by Victor Julien about 9 years ago

  • Target version set to TBD
Actions #3

Updated by Andreas Herz over 5 years ago

  • Assignee set to OISF Dev
Actions #4

Updated by Andreas Herz over 4 years ago

Wouldn't it be enough (since it's a corner case) to just use UTC?

Actions #5

Updated by Victor Julien about 3 years ago

  • Assignee changed from OISF Dev to Anonymous
  • Effort set to low
  • Difficulty set to low
Actions #6

Updated by Andreas Herz over 2 years ago

  • Assignee set to Community Ticket
Actions #7

Updated by Shivani Bhardwaj about 2 years ago

Is this still valid? Can I work on this?

Actions

Also available in: Atom PDF