Snort signature

Zeek
1

I used snort2bro and converted snort signatures into a snort.bro file
I gave bro snort.bro but it says
./snort.bro, line 1 (rule): error, undeclared variable

What should I do?

Antonatos Spiros

2

Currently, snort2bro needs a full Snort configuration (snort.cfg)
incl. variable definitions. Perhaps you've tried to convert only the
signatures themselves without the surrounding definitions given in
snort.cfg?

Robin

3

In addition (because, as it seems, it's not snort2bro which
complains but Bro itself): How did you call Bro? You need to specify
the converted signature file via the -s option as it's not a Bro
policy script.

Eventually, I will write some documentation of the signature
engine...

Robin

4

thanks for your interest. i didn't see the -s option :slight_smile: and i was giving
the rules file as a policy script. BTW, bro performs strings searching
by using an automaton?

Antonatos Spiros

5

Yes, it compiles the regular expressions into DFAs.

Robin