Hi, I am attempting to write a policy script for IMAP signatures adapted from Snort using 'snort2bro'. Is this the right way to write a policy script for the sample signatures below? I am not sure how to treat the 'tcp-state' part? Also, is it neccessary to use 'eval' each time? Suggestions/Po…

I am attempting to write a policy script for IMAP signatures adapted from Snort using 'snort2bro'. Is this the right way to write a policy script for the sample signatures below? I I'm not exactly sure what you would like to achieve. If you just want to get the same functionality that Snort pr…

Robin Sommer wrote: As written this signature will match for a given connection if (1) signature sid-1930 matches for the same connection, and if (2) the function "has_imapauthoverflow_been_attempted" evaluates to true. The latter happens if the same signature sid-1930 has already matched for …

Yes, right. Define a signature_match() handler and check if the triggering signature is one of those for which you would like the action to be taken. Actually, for things like this it would be better if you could specify some other handler than signature_match() within signature. I will probabl…

policy for IMAP signatures

Zeek

Topic		Replies	Views
Bro <-> Snort documentation Zeek	1	154	May 6, 2022
bro email, cleartext passwords and snort signature Zeek	3	130	May 6, 2022
create team for update snort2bro script signature ? Zeek	5	219	May 6, 2022
Adding new signatures Zeek	2	196	May 6, 2022
Using snort2bro Zeek	3	157	May 6, 2022

policy for IMAP signatures

Related topics