Subject: IDMEF XML plugin 0.2 for Snort

From: Joe McAlerney <[email-masked]>
Date: Fri, 01 Jun 2001 17:56:35 -0700

Greetings,

The IDMEF XML plugin has been updated to comply with libidmef 0.6, and
version 0.3 of the IDMEF specification.  Notable changes include:

+ Conformance to version 0.3 of the IDMEF specification 
+ Support for SPADE anomaly detection messages, as well as portscan
plugin messages
+ Additional OS platform support 
+ Support for new reference information in Snort rules

More information is available at
http://www.silicondefense.com/idwg/snort-idmef/
The plugin can be downloaded directly from this link
http://www.silicondefense.com/idwg/snort-idmef/idmef-xml-plugin_0.2.tar.gz

As I mention on the website, we are attempting to extract additional
information from Snort in order to produce more detailed IDMEF
messages.  For instance, although Snort's portscan plugin can produce
detailed information, a mechanism by which to pass it to an output
plugin (such as the IDMEF XML plugin) does not exist.  We have a working
prototype that does provide this functionality.  We hope to continue
working with other Snort developers, and incorporate what we have into
the main code base.  This will allow us to create much more detailed
messages in IDMEF.

Thank you,

Joe M.

-- 
|   Joe McAlerney     [email-masked]   |
| Silicon Defense - Technical Support for Snort |
|       http://www.silicondefense.com/          |
+--                                           --+