In this case a message failing GREY or EXPERIMENTAL will receive 10 + 15 = 25 points and all other result codes will receive 15 points
 
Remove the GREY and EXPERIMENTAL definitions, add all other result codes with a weight of 5 and assign 10 points to the SNIFFER nonzero line.
So GREY and EXP will receive 10 points and all other 10 + 5 = 15 points.
 
Keep in mind that Sniffer will run only one time even if you've 50 Sniffer-test definitions in your cfg file.
 
Markus
 
 


From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bonno Bloksma
Sent: Tuesday, June 22, 2004 2:59 PM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Sniffer and Declude

Hi,

I want to score sniffer higher in my Declude points but I don't want to score all sniffer results equal. There is an experimental group as well as a grey group which I would like to score at the level I have it now, where I mark the subject.
 
Do I need to define all sniffer external results, or can I have a few lines like:

SNIFFER-GREYMAIL external 060 ...\ID.exe AuthCode 10 0
SNIFFER-EXPERIMENTAL external 062 ...\ID.exe AuthCode 10 0
SNIFFER external nonzero ...\ID.exe AuthCode 15 0

Where the last line catches all other results of the test?

Groetjes,

Bonno Bloksma

Reply via email to