Snort 2 Bro Utility

Zeek
1

Dear Team,

Can anyone please share snort2bro utility as i just wanted to know how the conversion is done. It will help me writing signatures.

Regards,

Rahul

2

Rahul,

That utility has been long deprecated, largely due to difference in approach by Snort and Bro.

I’ll share the demo signature below. As always, feel free to reach out directly, should you need.

signature my-first-sig {
    ip-proto == tcp
    dst-port == 80
    payload /.*root/
    event "Found root!"
}