GEO IP
Idea is to add a keyword that would be used to interact with GEOIP database (free at least) and be able to use it to detect things like control canal. For example, an IRC server in an non common country is certainly a control canal.
Live ruleset swap
A must have! This is vital for critical environnement. This is very costly in memory and this should be an option to avoid exploding low memory boxes.
Qosmos integration / API for data exchange
Bringing protocol analysis is an interesting point as it will help to increase performance and accuracy of the engine. Knowing the protocol permit to only run protocol related rules to flow of that protocol. And this avoid to have false detection by running the rules on bad protocol. OpenDPI technology and Qosmos technology integration is discussed. A common API is needed to be able to use both systems.
Global shared flowvars
Global flow var will permit to change the way we build rules. Not being constrained anymore to stream variable will increase the power of rules.
Host/app/OS table import
Idea is to load host type from file to be able to tune the host setting precisely.
IPFIX support
IPFIX support as entry or output could bring some advantages.
Conclusion
Matt Jonkman and Victor Julien will now summarize the input and publish on OISF website the planned features for phase 3 based on discussion about priority of the tasks that have been held.