inliniac/suricata — pull request #132 by dabarb1 (2012-10-09 18:06:01+00:00)
Title: Portable Executable header anomaly scanner - update 2

Updated revision - code style, build scripts, misc feedback

This patch details the changes made to the Suricata baseline for integrating the PEScan service. The service involves creating a detection engine keyword 'pescan' that matches when a PE file is detected via a byte scanner, or when the file has an anomaly score that meets certain condition criteria. In addition, when PE files are detected, their header and anomaly flag information is logged to a separate file (pescan.log) using the logging module.