[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: Re: [cti-stix] RE: Indicators and patterning
Wunder, John A. wrote this message on Tue, Oct 25, 2016 at 22:28 +0000: > Since an indicator can now have more than one pattern we need some text to call out how they're related (are they alternatives? do they need to test for the same exact things? Is one preferred?) If we support both/multiple, they need to be equivalent. Otherwise if one implementation picks YARA, and the other picks native, they won't operate the same. -- John-Mark
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]