# How to write a signature definition for (event\_A AND event\_ B)?

**URL:** <https://community.zeek.org/t/how-to-write-a-signature-definition-for-event-a-and-event-b/1418>\
**Category:** Zeek\
**Created:** [October 21, 2008, 9:42pm UTC](https://community.zeek.org/t/how-to-write-a-signature-definition-for-event-a-and-event-b/1418 "2008-10-21T21:42:19Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bogdan\_Koziol](https://avatars.discourse-cdn.com/v4/letter/b/a587f6/32.png) [@Bogdan\_Koziol](https://community.zeek.org/u/Bogdan_Koziol)\
**Post date:** [October 21, 2008, 9:42pm UTC](https://community.zeek.org/t/how-to-write-a-signature-definition-for-event-a-and-event-b/1418/1 "2008-10-21T21:42:19Z")

</div>

Hallo everybody,

I'm a new and unexperienced user of the really interesting BRO detection  
framework. I want to write a signature definition for event A and B, which  
triggers only after event A and B happend. My approach so far:

signature s1 {event "Pattern A"}

signature s2 {event "Pattern B"  
&nbsp;&nbsp;&nbsp;requires-signature s1  
}

If i understood the documentation correctly, i can define an event sequence  
with the "requires-signature" condition.

But this one only matches events (A, B) and not (B, A).

Is it possible to write an event expression (A AND B)?

Kind regards,  
Bogdan.

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [October 22, 2008, 9:37pm UTC](https://community.zeek.org/t/how-to-write-a-signature-definition-for-event-a-and-event-b/1418/2 "2008-10-22T21:37:04Z")

</div>

Not directly with the signature language. You can however write a  
Bro script (i.e., a script in Bro's primary language) which keeps  
track of which signatures have matched so far. This way you can  
implement arbitrary dependencies.

Robin

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/how-to-write-a-signature-definition-for-event-a-and-event-b/1418/3 "2022-05-06T15:38:43Z")

</div>