PPT Slide

SARA Filters

• rules/drop:
  • drops a global element from database
  • no record of element is kept
  • sample:

$text =~ /exports \/cdrom/i

$service_output =~ /JD FTP/ && $text =~ /offers ftp/

$service_output =~ /Lexmark/ && $text =~ /offers ftp/

• rules/corrections (can be added interactively [SARA5]):
  • usually used to remove false positives
  • drops host oriented element from reports
  • sample:
    localhost|smtp relay|Bob Todd|20 October 2000

Previous slide

Next slide

Back to first slide

View graphic version