<!DOCTYPE html PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'>
<html><head><meta http-equiv="Content-Type" content="text/html;charset=us-ascii">
<style>BODY{font:10pt Tahoma,Verdana,sans-serif} .MsoNormal{line-height:120%;margin:0}</style></head><body>
And would give Suricata the edge over many competing technology. <br><br>Leonard<br><div><br></div><div><br></div><blockquote style="padding-left: 5px; margin-left: 5px; border-left: #0000ff 2px solid; margin-right: 0px"><hr><b>From:</b> Cooper F. Nelson [mailto:cnelson@ucsd.edu]<br><b>To:</b> Leonard Jacobs [mailto:ljacobs@netsecuris.com], Kelley Misata [mailto:kelley@openinfosecfoundation.org], oisf users [mailto:oisf-users@openinfosecfoundation.org]<br><b>Sent:</b> Fri, 02 Oct 2015 11:32:58 -0600<br><b>Subject:</b> Re: [Oisf-users] New Post by OISF Board Member Randy Caldejon<br><br>-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA1<br>
<br>
I've been doing behavioral analysis on suricata effectively for a few<br>
years using custom rules and post-processing of the alert files.<br>
<br>
This works well enough, but I will admit a more robust implementation<br>
that includes some sort of scripting engine would be a fantastic addition.<br>
<br>
On 10/2/2015 7:03 AM, Leonard Jacobs wrote:<br>
> Nicely done. Randy, glad to see I am not the only board member that<br>
> believes behavioral analysis is needed in Suricata.<br>
> <br>
> I look forward to see everyone in Barcelona. It is going to be an<br>
> exciting conference.<br>
> <br>
> Leonard Jacobs, MBA, CISSP, CSSA<br>
> President/CEO<br>
> Netsecuris Inc.<br>
> P 952-641-1421 ext. 20<br>
> <a href="http://www.netsecuris.com" target="_blank">http://www.netsecuris.com</a><br>
<br>
<br>
- -- <br>
Cooper Nelson<br>
Network Security Analyst<br>
UCSD ACT Security Team<br>
<a href="mailto:cnelson@ucsd.edu">cnelson@ucsd.edu</a> x41042<br>
-----BEGIN PGP SIGNATURE-----<br>
Version: GnuPG v2.0.17 (MingW32)<br>
<br>
iQEcBAEBAgAGBQJWDrG6AAoJEKIFRYQsa8FWKGIIAKz5vZxGYUSS/ZjpS163X/7o<br>
Wohhrm43/kaS6cyXyJhlVrMeKpp7Punh5vF59cueyqT1EzVKtnkSTqPHwn5OsUBI<br>
8HDnK9Th3BUZG8oQ675T4oOqF0UOoeA3myU6n94IqcgTGzRpL8KQg6igqcagTwLM<br>
ND+wAq0D8BQoM/Zw5HCxurtHJ3n2pHxPsAxMPkqIq4JECw1HlS2DB/a/DtfI35Cx<br>
sMvc6L1EA9zifHm+Zy/DpRbw8d/SClajBwLBVC1oZD8Dri/4KNu2PnTyJQcMjc+g<br>
8tNzHDnEdPaBBWVrMWggn5wdkBlM0nnpdSdnQJ4VTHdVrNlCHbPPsU7tu5bB+Jw=<br>
=v92B<br>
-----END PGP SIGNATURE-----<br>
</blockquote><style>
</style>
</body></html>