Content Packs and disabling rules

[Former Member]

Actually there is a single PM responsible for content packs and he's meticulous and always looking for feedback. Please forward or post suggestions and you'll see a quick response.

I think the difference is that the Global Filter (as it is when used for views) includes the regex functionality, but the Policy Editor doesn't. It would be a nice to have for the Policy Editor but I think we'll see a new UI first.

[mark.riddick]

I'd be happy to liaise with the PM directly but in lieu of that, the points highlighted in thread would be a good start ie consistency within the various content packs for listing rules to be disabled. I think that the application of Content Packs should be simplified whether it be for McAfee PS, Consultants/Partners or the end user.

I'm sure we will see a new UI first... HTML5 etc, etc. All well and good but it doesn't seem likely to address one on my clients' biggest bug bears. No right click functionality. But I digress. The filter issue, in this case, is between Global Filters and alarms & correlation rules. It does beg the question why some functionality is available in some places and not others. Ever the spotted the inconsistency in whether a modal window can be maximised or not?

[Former Member]

I'll highlight this thread for him. The only place I see the sig ID's listed is in the Content Pack description and they don't have spaces. Is there another place they are listed?

As for the UI, I'll say with first hand knowledge that there is most definitely a right-click. I appreciate the flash UI for what it is but it helps sometimes to know the back stories of how some of the features came to be. There's usually a reason something is the way it is, but not always

[mark.riddick]

Look at the the DNS and DoS packs. The content description lists the Sig IDs to be disabled but they are comma delimited WITH spaces. Then look at the Recon pack. That one shows the Sig IDs comma delimited with no spaces. Consistency...

So, you're saying that the next release has a usable right click function? By usable, I mean something like showing the equivalent of Event Summary|Event Drilldown|Events at the very least.

[Former Member]

Thanks for pointing them out. I'll see what I can do.

And yes, 10.0 will include useful right-click functionality.