Skip to content

Add flowbits feature from Snort/Suricata #17

@Xumeiquer

Description

@Xumeiquer

Adding this feature will allow MoleIDS to detect multi-phase attacks.

It could be implemented adding a new entry in the meta section, for example:

rule dummy {
    meta:
        // ...
       flowbits = "set:variable, isset:variable, unset:variable"
    // ...
}

The meta entry flowbits will be a comma separated string with key:value options. The key will be the operation against the flowbits and the value will be the variable where the action takes effect.

It will be also possible to reuse operations, like set:var1, set:var2.

Metadata

Metadata

Assignees

Labels

enhancementNew feature or request

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions