Guys,
I'm working on replacing the SOUGHT rule generation-
Atm SOUGHT rule generation is on autopilot and JM would like to shut
his part down (cost, time, etc)
Apart from using SA's trap data, so as to have a wider data scope,
I'd like to ask if you'd be willing to contribute with an extra
masscheck run which would search for strings in spam/ham and rsync these
logs to a new path on the SA infra.
From there on the rule generation routines will take over and push
SA_AUTOGEN_* to a sa-update channel on SA's mirrors.
We may either use a separate sa-update channel or use the default which
would probably be easier - this depends on the PMC's decision.
If there's enough ppl willing to contribute with this, I'll glue my
snippets together as a simple masscheck script for this and put it on
SA's SVN
Comments, suggestions?
Pls raise your hands so we can make this happen
Axb
