On Wednesday 18 February 2004 11:49 am, Chris Santerre wrote: > Yes and no. :-) > > Not in any release of SA as of yet. Although someone did write an eval to > add to SA that does just this. I have it, and like everything in my office, > it is lost somewhere in the vastness of knowledge...(OK, clutter!) I'll see > if I can dig it up. > > --Chris > > > Is it possible to score a single rule additively? That is, the rule's > > final score is the sum of the number of times it matched, rather than > > simply whether or not it matched? > > > > There are several good applications for this, particularly in relation > > to HTML mail.
This is exactly what I've been complaining about with regard to too-long SA reports (but kind of a different tack on it). These huge sets of little rules (Tripwire, etc) would be much improved with a single additive score like Mr. Hardin described. -- Matt Systems Administrator Local Access Communications 360.330.5535
