{"action":"created","issue":{"url":"https://api.github.com/repos/inliniac/suricata/issues/1414","repository_url":"https://api.github.com/repos/inliniac/suricata","labels_url":"https://api.github.com/repos/inliniac/suricata/issues/1414/labels{/name}","comments_url":"https://api.github.com/repos/inliniac/suricata/issues/1414/comments","events_url":"https://api.github.com/repos/inliniac/suricata/issues/1414/events","html_url":"https://github.com/inliniac/suricata/pull/1414","id":67387339,"number":1414,"title":"Introducing a base line of protocol-anomalies.rules","user":{"login":"pevma","id":1405917,"avatar_url":"https://avatars.githubusercontent.com/u/1405917?v=3","gravatar_id":"","url":"https://api.github.com/users/pevma","html_url":"https://github.com/pevma","followers_url":"https://api.github.com/users/pevma/followers","following_url":"https://api.github.com/users/pevma/following{/other_user}","gists_url":"https://api.github.com/users/pevma/gists{/gist_id}","starred_url":"https://api.github.com/users/pevma/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pevma/subscriptions","organizations_url":"https://api.github.com/users/pevma/orgs","repos_url":"https://api.github.com/users/pevma/repos","events_url":"https://api.github.com/users/pevma/events{/privacy}","received_events_url":"https://api.github.com/users/pevma/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-04-09T15:30:57Z","updated_at":"2016-02-16T07:51:59Z","closed_at":"2016-02-16T07:51:59Z","pull_request":{"url":"https://api.github.com/repos/inliniac/suricata/pulls/1414","html_url":"https://github.com/inliniac/suricata/pull/1414","diff_url":"https://github.com/inliniac/suricata/pull/1414.diff","patch_url":"https://github.com/inliniac/suricata/pull/1414.patch"},"body":"This patch introduces protocol-anomalies.rules file containing\r\nexamples of Protocol Anomaly Detection rules for Suricata IDPS"},"comment":{"url":"https://api.github.com/repos/inliniac/suricata/issues/comments/184564039","html_url":"https://github.com/inliniac/suricata/pull/1414#issuecomment-184564039","issue_url":"https://api.github.com/repos/inliniac/suricata/issues/1414","id":184564039,"user":{"login":"inliniac","id":719366,"avatar_url":"https://avatars.githubusercontent.com/u/719366?v=3","gravatar_id":"","url":"https://api.github.com/users/inliniac","html_url":"https://github.com/inliniac","followers_url":"https://api.github.com/users/inliniac/followers","following_url":"https://api.github.com/users/inliniac/following{/other_user}","gists_url":"https://api.github.com/users/inliniac/gists{/gist_id}","starred_url":"https://api.github.com/users/inliniac/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/inliniac/subscriptions","organizations_url":"https://api.github.com/users/inliniac/orgs","repos_url":"https://api.github.com/users/inliniac/repos","events_url":"https://api.github.com/users/inliniac/events{/privacy}","received_events_url":"https://api.github.com/users/inliniac/received_events","type":"User","site_admin":false},"created_at":"2016-02-16T07:51:59Z","updated_at":"2016-02-16T07:51:59Z","body":"I think the depth of our detection for ftp, smtp, imap, smb and dcerpc isn't suitable for this type of rule, so I prefer to have them removed to prevent confusion from users.\r\n\r\nPR needs be rebased to resolve conflict."}}