stream, decoder events must be disabled by default about scirius HOT 4 CLOSED

This is more a SELKS problem. Closing that.

from scirius.

I believe it is Scirius that deals with it at the end - without regards on which OS and/or distro it is used on.

Due to the fact that the above mentioned rules usually generate a lot of alerts, they are disabled by default in suricata.yaml.

Why would Scirius deviate from that suggested approach?

from scirius.

Scirius don't come with any rules installed. So I don't see the point of
reopening this.
Le 14 août 2014 21:02, "Peter Manev" [email protected] a écrit :

I believe it is Scirius that deals with it at the end - without regards on
which OS and/or distro it is used on.

Due to the fact that the above mentioned rules usually generate a lot of
alerts, they are disabled by default in suricata.yaml.

Why would Scirius deviate from that suggested approach?

—
Reply to this email directly or view it on GitHub
#5 (comment)
.

from scirius.

Scirius is agnostic regarding the rules sources and since we don't
want to hard-code anything in Scirius 0.6 there were updates/changes
allowing for per category rule disabling addressing exactly that
issue.

understood the new updates are in place - thanks Regit

from scirius.