Now that autocat information is stored in the Sguil database, it would be nice to have a comment in autocat.conf to point the user towards the autocat builder in the Sguil client for adding autocat rules.
Ex.
"This file is no longer used to process autocat rules, as autocat information is now stored in the Sguil database.
If you would like to add new autocat rules, please do so via the autocat builder in the Sguil client."
Now that autocat information is stored in the Sguil database, it would be nice to have a comment in autocat.conf to point the user towards the autocat builder in the Sguil client for adding autocat rules.
Ex. "This file is no longer used to process autocat rules, as autocat information is now stored in the Sguil database. If you would like to add new autocat rules, please do so via the autocat builder in the Sguil client."
Thanks, Wes