Re: razor2 question

[Matt Kettler <mk...@comcast.net>]

At 03:19 PM 1/14/2006, Leonardo Rodrigues Magalhães wrote:

>    Hi Guys,
>
>    I know this isnt a razor mailing list, but as lots of people that uses 
> SA also uses Razor2, i will ask here too :)
>
>    Are the results from Razor2 Engine 8 more trustable than Engine 4 ?? I 
> mean ... i was thinking of rewrite some rules and give high score for 
> Engine8 than for Engine4. What do you think on that ?


Personaly I find E8 to have substantially more FPs than E4.

That said, why would you want to write separate rules, they already exist 
in SA 3.1.0:


score RAZOR2_CHECK 0 0.5 0 0.5
score RAZOR2_CF_RANGE_51_100 0 0.5 0 0.5
score RAZOR2_CF_RANGE_E4_51_100 0 1.5 0 1.5
score RAZOR2_CF_RANGE_E8_51_100 0 1.5 0 1.5

Really all you'd have to do is tweak the score.

Keep in mind that if either RAZOR2_CF_RANGE_E4_51_100 or 
RAZOR2_CF_RANGE_E8_51_100 fires off, the other two will also fire, making 
it a 2.5 point score. If both e4 and e8 fire off in the 51 to 100 range, 
then it will total up 4.0.

If razor fires off and is above min_cf but under 51, it will only rack up 
0.5 points from RAZOR_CHECK.