# Signature example

**URL:** <https://community.zeek.org/t/signature-example/3691>\
**Category:** Zeek\
**Created:** [July 7, 2015, 9:02am UTC](https://community.zeek.org/t/signature-example/3691 "2015-07-07T09:02:53Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vito\_Logrillo](https://avatars.discourse-cdn.com/v4/letter/v/e9bcb4/32.png) [@Vito\_Logrillo](https://community.zeek.org/u/Vito_Logrillo)\
**Post date:** [July 7, 2015, 9:02am UTC](https://community.zeek.org/t/signature-example/3691/1 "2015-07-07T09:02:53Z")

</div>

Hi all,  
i'm studying the signature framework using the example described in  
[https://www.bro.org/sphinx/frameworks/signatures.html](https://www.bro.org/sphinx/frameworks/signatures.html)

I've made two files  
-----mysig.sig----  
signature my-first-sig {  
&nbsp;&nbsp;&nbsp;&nbsp;ip-proto == tcp  
&nbsp;&nbsp;&nbsp;&nbsp;dst-port == 80  
&nbsp;&nbsp;&nbsp;&nbsp;payload /.\*root.\*/  
&nbsp;&nbsp;&nbsp;&nbsp;event "Found root!"  
}

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/signature-example/3691/2 "2022-05-06T15:42:50Z")

</div>