Showing posts with label signatures. Show all posts
Showing posts with label signatures. Show all posts

Friday, January 18, 2013

PSAD and signature updates

Is it true that the creators of PSAD haven't updated the PSAD signatures since 2007???

Line 29 of my /etc/psad/signatures file:

# $Id: signatures 2129 2007-12-12 04:56:10Z mbr $

As well, at http://www.cipherdyne.org/psad/signatures, it is on line 28.

Dead project?  Not sure, but the signatures are old as hell!  While I don't think it's a usage deal-breaker, I'm rather surprised.  Does it need updated signatures?  Probably not, but every little bit helps, especially nowadays.  I'd much rather a developer (and package maintainer) be up-front about such things.

Sunday, November 15, 2009

Emergingthreats.com sigs...

Quick note:

One thing I hate about emergingthreats.com sigs is the fact that the sigs have no real documentation. Yeah, I know there's a site (a few, in fact) that provide this (via opensource efforts), but I much prefer to not have to research each and every sig all the time I'm investigating something.