I'm trying to learn zeek signature
signature file name: dns.sig
signature dns-intel{
ip-proto == udp
dst-port == 53
payload /.*life|.*bar/
event "[Suspicious DNS Query]" }
Zeek file name: myfirst.zeek
event signature_match (state: signature_state, msg: string, data: string) {
if (state$sig_id == "dns-intel") {
print fmt ("[Suspicious DNS query] %s", state$conn$dns$query)
}
I'm getting error in line 5 : rule defined twice
what's the problem here ??
}