Signatures

[dead42]

Is there an ability or a way to construct a signature that creates an alert that alerts to things like multiple attempts to connect to a monitored AP device that have failed within a given time or from a specific Client. I am researching ways to detect some of the Dragonblood attacks?

[lennartkoopmann]

Hi! Very good question. A more generic approach to WiFi and Bluetooth monitoring is in active development. I can't promise that the first version will allow you to do exactly what you describe, but it will allow you to chain different rules together and trigger events based on them.

Please give it a try once released and let us know what's missing or could be improved. I'll take your example rule into account for this feature.