Cisco-Talos / CASC

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Include IDA comments in the detection breakdown

nicklister opened this issue · comments

It would be very helpful if IDA comments were included in the [DETECTION BREAKDOWN] generated by CASC. It would make things easier for the signature author to document why they are targeting a certain section of code. Also the auto-generated comments by IDA for things like ASCII strings would be helpful too. This would provide the signature reviewer with more context when they review the sig.