Matt Jonkman just announced that the first stats of SidReporter are available here. Matt writes:
These will become more interesting the more sites we have reporting, so please consider running the client. It’s painless, anonymous, and will contribute to us greatly improving the signature base we all use.
It will be interesting to see what data this can bring us. Congrats Matt!
A little over a week ago the second beta of the SidReporter from Emerging Threats was released (see http://www.emergingthreats.net/content/view/95/1/). I’ve been working with Matt Jonkman to setup this new project at Emerging Threats, mostly in writing the reporter scripts. I think it’s an exciting new project that could provide the community with great information. As Matt wrote on the initial announcement:
“As mentioned a few weeks ago, we’ve been working to bring out tool to anonymously report IDS/IPS hits. Similar to DShield’s firewall log reporting, we believe we can make some incredible data inferences with this information, as well as help improve the quality of our signatures while giving us all feedback to tune our rulesets.
But that’s just the start. As with DShield’s data, I think we’ll run into benefits to the community that we can’t even imagine until we start to look at the data.”
The next step for the reporter is adding support for getting the events from Sguil. Expect to see that soon!