Re: Snort.org Blog: Snort 2.9.1 HTTP and SMTP logging features

[Jason Haar <Jason.Haar () trimble co nz>]

On 18/09/11 04:52, Joel Esler wrote:
> If there is a demand for it, I'm sure we could add it to a future
> release.  We started with HTTP and SMTP because those were the two
> that had the biggest amount of people asking for it.

I don't know what Sourcefire's intended direction is for DLP, but being
able to detect "files" would be a key component. The current eventing
system is pretty poor for DLP: eg alerting on PII in the middle of a
CIFS/FTP/whatever session  is pretty useless when the server is being
simultaneously used by 1,000+ people - you need to know the user and the
/path/filename

Jason

-- 
Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1


------------------------------------------------------------------------------
BlackBerry® DevCon Americas, Oct. 18-20, San Francisco, CA
http://p.sf.net/sfu/rim-devcon-copy2
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!