Analyzer classification

Hi folks,

I started an Analyzer classification page on our tracker, at the
following URL: https://trac.prelude-ids.org/wiki/AnalyzerClass

If you look closer to the "How to classify ?" section, you will see a
table of classification names, description and example of use.

The idea is to let the operator understand better the analyzer type
which sent the alerts he/she is monitoring. We must abstract the
analyzer name into a classification, so that you do not need to bother
that say what Ossec is, but reading the classification, which is "File
Integrity Checker, Logs Analyzer". And the classification is enough to
understand what we can expect from such a Host IDS (low rate of false
positives etc..).

Could you please:
1) Check that the sensor you developed, ported Prelude to or are
planning to develop is complies to the classification in the table
2) Add any missing classification


Thank you,
Sebastien.
_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel