Snort to Bro

Zeek
1

hi there

How can i convert Snort rules to BRO ?

regards,
Jules

2

Bro ships with a script snort2bro but is it somewhat outdated and
does not support some of the newer Snort options.

Robin

3

Thanks Robin

is there any better solution? Can i just rely on Bro policies? will that be enough? is there a real difference betwen the snort rules and Bro policies?

Robin Sommer wrote:

4

Well, the systems' detection approaches are quite different. Bro
does not primarily rely on pattern matching as Snort does; its
policies use a different abstraction. You can't really compare the
two.

Robin