inliniac/suricata — pull request #116 by dabarb1 (2012-10-03 16:51:14+00:00)
Title: Portable Executable header anomaly scanner

This patch details the changes made to the Suricata baseline for integrating the PEScan v1.0 service. The service involves creating a detection engine keyword 'pescan' that matches when a PE file is detected via a byte scanner, or when the file has an anomaly score that meets certain condition criteria. In addition, when PE files are detected, their header and anomaly flag information is logged to a separate file (pescan.log) using the logging module.