<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>Eric, et. al,</p>
<p>Do you think it is still justifiable to have a separate "target"
keyword or would it make more sense to leverage the "metadata"
keyword to store this information, and encourage rule writers to
put it there? Personally, I'm more in favor of the latter since
the metadata keyword is already used to store rule classification
information, and at this point the "target" keyword seems like a
confusing "one-off" feature. And if rule writers haven't
incorporated using the "target" keyword by this point, it
shouldn't be too painful to tell them to stick it in the metadata
keyword instead.<br>
</p>
<p>-David</p>
<p><br>
</p>
<div class="moz-cite-prefix">On 7/15/19 4:44 PM, Champ Clark III
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:1940199243.11494792.1563223475939.JavaMail.zimbra@quadrantsec.com">
<pre class="moz-quote-pre" wrap="">
First off, thank you for the response....
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">This can be solved by using the target keyword that indicate which side
is the bad side. Rules writers seems not to have picked it (bad rules
writers) and that is a shame. Yes, please use this, it is trivial when
writing rules !
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
Thinking about it, I really should have considered the "metadata" keyword from the beginning. I'll definitely move the options there. This allows for a lot more flexibility.
I was not aware of the "target" keyword. I just did a quick test and the "target" was nicely recorded in the EVE output. However, I'm not sure if I will need it. As you pointed out, it isn't used very often. In fact, I could not find one "target" keyword used in the ET rule set.
Again, thank you for the advice!
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<pre class="moz-quote-pre" wrap="">_______________________________________________
Suricata IDS Users mailing list: <a class="moz-txt-link-abbreviated" href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a>
Site: <a class="moz-txt-link-freetext" href="http://suricata-ids.org">http://suricata-ids.org</a> | Support: <a class="moz-txt-link-freetext" href="http://suricata-ids.org/support/">http://suricata-ids.org/support/</a>
List: <a class="moz-txt-link-freetext" href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a>
Conference: <a class="moz-txt-link-freetext" href="https://suricon.net">https://suricon.net</a>
Trainings: <a class="moz-txt-link-freetext" href="https://suricata-ids.org/training/">https://suricata-ids.org/training/</a></pre>
</blockquote>
</body>
</html>