<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta content="text/html;charset=UTF-8" http-equiv="Content-Type"></head><body ><div style='font-size:10pt;font-family:Verdana,Arial,Helvetica,sans-serif;'><div>Forgive me for interjecting. </div><div><br></div>I think it is extremely important not for the engine necessarily, but for event analysis.<div>Having all relevant data in one place is very valuable. This goes beyond simple stats. </div><div><div><div><div class="zmail_extra"><div id="1"><br></div><div id="1">Thanks</div><div id="1">Kevin Buchanan</div><div id="1">CTO Promithius</div><div id="1"><br>---- On Wed, 19 Oct 2016 13:55:11 -0700 <b>Andreas Herz<andi@geekosphere.org></b> wrote ---- <br></div><blockquote style="border-left: 1px solid #0000FF; padding-left: 6px; margin:0 0 0 5px"><div>On 18/10/16 at 17:44, Devanath S wrote:<br>> Hi *,<br>> <br>> Snort/cisco and Palo alto n/ws talk very high about openAppId support. Does<br>> Suricata support openAppId? or does it have something similar. Please<br>> suggest.<br><br>There was a discussion some time ago:<br><br><a href="https://lists.openinfosecfoundation.org/pipermail/oisf-users/2015-January/004498.html" target="_blank" rel="noreferrer">https://lists.openinfosecfoundation.org/pipermail/oisf-users/2015-January/004498.html</a><br><br>So it might be nice to support it, but IMHO it's not as nice as it<br>sounds. But if anyone wants to support/add it, contribute it :)<br><br>There might be more need for DPI similar support to detect more<br>applications especially within HTTP traffic.<br><br><br>-- <br>Andreas Herz<br>_______________________________________________<br>Suricata IDS Devel mailing list: <a href="mailto:oisf-devel@openinfosecfoundation.org" target="_blank" rel="noreferrer" mailid="oisf-devel%40openinfosecfoundation.org" subj="">oisf-devel@openinfosecfoundation.org</a><br>Site: <a href="http://suricata-ids.org" target="_blank" rel="noreferrer">http://suricata-ids.org</a> | Participate: <a href="http://suricata-ids.org/participate/" target="_blank" rel="noreferrer">http://suricata-ids.org/participate/</a><br>List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel" target="_blank" rel="noreferrer">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel</a><br>Redmine: <a href="https://redmine.openinfosecfoundation.org/" target="_blank" rel="noreferrer">https://redmine.openinfosecfoundation.org/</a><br>Suricata User Conference November 9-11 in Washington, DC: <a href="http://suricon.net" target="_blank" rel="noreferrer">http://suricon.net</a><br></div></blockquote><br></div><br></div></div></div></div></body></html>