Re: LOGS: GIAC GCIA Version 3.5 Practical Detect DarinMarais

lola marais wrote:

10. Multiple choice test questions:
When writing snort signatures for content matching, the parameter 
"isdataat" is used to indicate to the snort process to
a) Hide all email addresses used in the in the signature description.
b) Look for defined conditions, x bytes beyond the previous content 
string match
c) Look for defined conditions, x bytes before the previous content 
string match
answer = b

In your text you explain the above. However, the snort rule shown has 
this :

isdataat:6,relative;

The relative keyword is optional, and consequentaly, your answer above 
could be misleading.

Regards





_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions