Casey Stella created METRON-488:
-----------------------------------
Summary: Snort should use a proper CSV implementation
Key: METRON-488
URL: https://issues.apache.org/jira/browse/METRON-488
Project: Metron
Issue Type: Bug
Reporter: Casey Stella
Assignee: Casey Stella
Right now if you have a custom snort rule (e.g. alert tcp any any -> any any
(msg:'snort alert message having a ,(comma) to check csv parsing'; sid:999158;
) ) the snort parser will fail to parse because it's splitting on the comma
naively.
It should use the existing CSV parsing infrastructure that we have and that is
used in the CSVParser.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
