Topic for small fixes/questions

[Stefan Kleindl]

classification.config
[**] [5000075] [OPENSSH] Authentication success [**]
[Classification: successful-user] [Priority: 1]

Success should be 3, no?

[Da Beave]

Hmm.. Yeah, I'd think it should be a lower level alert. 3 sounds
good. WIll change ASAP.

[Da Beave]

Actuall, let me look into this. This might have been on par with how
Snort classified it. I can't recall if "successful-user" is a Snort
classification or one only for Sagan. Anyways, I'll check and let
you know.

[Da Beave]

I've been out of the loop for the last couple weeks of bit due to some
major changes where I work. Basically, I've been moving a data center
which has taken a lot of my time over the last few weeks. Fortunately,
that's coming to a close. Yesterday, I just got my new development box
online, which I intend to use for Sagan/Sagan-rules.

First off, I need to look into some reported liblognorm issues.
I also need to update some rules.

--
Champ Clark III | Softwink, Inc | 800-538-9357 x 101
http://www.softwink.com

GPG Key ID: 58A2A58F
Key fingerprint = 7734 2A1C 007D 581E BDF7 6AD5 0F1F 655F 58A2 A58F
If it wasn't for C, we'd be using BASI, PASAL and OBOL.

[Da Beave]

config classification: successful-user,Successful User Privilege Gain,1

That's from Snort's configuraton,  which I attempt to stay in line with.  However,  you can change it from 1 to 3. 
Or just disable those rules.