BRO signature

Zeek
1

Sir/Mam

I am new at bro i have install 2.3.2 . I want to create a signature framework i have read the document provided on bro website but i cannot understand how to execute it i.e

signature my-first-sig {
    ip-proto == tcp
    dst-port == 80
    payload /.*root/
    event "Found root!"
}


i taken this code from your site but it is not running is it require addition coding


please tell me what to do now.


thank you


waiting for your early reply
2

Place your signature in a file named “mysig.sig”. Then create another file called “myscript.bro”. Within this file, use the @load-sigs directive to load “mysig.sig”. When you run Bro be sure to tell Bro to include “myscript.bro”. You’ll also need to write an event handler for when your signature is matched.

See here https://www.bro.org/sphinx-git/frameworks/signatures.html

-AK