# Zeek Community Signatures

**URL:** <https://community.zeek.org/t/zeek-community-signatures/6285>\
**Category:** Zeek\
**Created:** [January 5, 2021, 12:16pm UTC](https://community.zeek.org/t/zeek-community-signatures/6285 "2021-01-05T12:16:37Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ilayda\_Gundogdu](https://avatars.discourse-cdn.com/v4/letter/i/b487fb/32.png) [@Ilayda\_Gundogdu](https://community.zeek.org/u/Ilayda_Gundogdu)\
**Post date:** [January 5, 2021, 12:16pm UTC](https://community.zeek.org/t/zeek-community-signatures/6285/1 "2021-01-05T12:16:37Z")

</div>

Hello,

I am working on a thesis related Analysis and Comparison of Open Source IDSs with public signatures.I want to run Zeek with signatures like Snort and Suricata signatures but i couldn’t find community signatures about Zeek.Also brocata signatures didn’t run on Zeek. Can you help me about is there any public signatures for Zeek?

Thank you for your replies.

---

<div class="post-metadata">

**Author:** ![Richard\_Bejtlich](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/richard_bejtlich/32/597_2.png) [@Richard\_Bejtlich](https://community.zeek.org/u/Richard_Bejtlich)\
**Post date:** [January 6, 2021, 12:21pm UTC](https://community.zeek.org/t/zeek-community-signatures/6285/2 "2021-01-06T12:21:13Z")

</div>

Hello,

I am happy to hear you are working on open source security, but sad to hear about this topic.

Did your professor assign this to you? We see the same question several times a year from students. It’s usually the result of a professor who does not understand the state of IDS software.

This sort of project has not made much sense for the last ten or so years. Snort and Suricata are essentially the only open source IDS’ left. They run essentially the same rule sets.

You might be able to compare them directly, but for how most people use them, the differences are negligible.

Zeek is very different. Zeek does not use byte matching signatures like Snort and Suricata. Comparing them on a signature basis is irrelevant. Many shops run both Zeek and Suricata in parallel because they have different functions.

If you have some freedom to change your topic, I bet we could help you develop something more relevant?

Sincerely,

Richard

---

<div class="post-metadata">

**Author:** ![Patrick\_Kelley](https://avatars.discourse-cdn.com/v4/letter/p/a87d85/32.png) [@Patrick\_Kelley](https://community.zeek.org/u/Patrick_Kelley)\
**Post date:** [January 6, 2021, 8:48pm UTC](https://community.zeek.org/t/zeek-community-signatures/6285/3 "2021-01-06T20:48:07Z")

</div>

You can write signatures for Zeek, but that really isn’t the purpose of the platform.

You can leverage threat intelligence feeds to cover some of the traditional IDS functions.

[https://github.com/CriticalPathSecurity/Zeek-Intelligence-Feeds](https://github.com/CriticalPathSecurity/Zeek-Intelligence-Feeds)

The following example can be used to write a signature.

```auto
signature my-first-sig {
    ip-proto == tcp
    dst-port == 80
    payload /.*root/
    event "Found root!"
}

```

```auto
Glad to assist you further in any way that I can.

```

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:47pm UTC](https://community.zeek.org/t/zeek-community-signatures/6285/4 "2022-05-06T15:47:33Z")

</div>