| http://www.w3.org/ns/prov#value | - But that is maybe one day out of the month.For new worms its critical that you have some kind of anomaly detection (1 host scans 100, 10 hosts scan 5 or more, etc...) turned on.There is a great article out there about baselining and tuning snort out there which is almost a must read.
|
