@Mephux that'll be great in the Snorby interface. It'll be one of the two that support those fields. The other being Sourcefire :) SecuObs - L'observatoire de la sécurite internet - Site d'informations professionnelles francophone sur la sécurité informatique