False positive

Zeek
1

Hi, I saw at documentation about snort2bro, it converts Snort's signature
into Bro signatures, I think using this I will analyse the alerts like I
need.

How can I obtain the snort2bro script to do this convertation? or Does the
bro have another way to analyse de signatures?

Thanks
Angelita

2

Hi,

3

Do I need to configure all configuration files like s2b.cfg, s2b-augment.cfg
? Or Do I have to execute this script with another parameters to convert de
signatures?

4

See scripts/s2b/README, be creative, or better yet, read the code. :slight_smile:

Cheers,
Christian.