Snort mailing list archives
Re: Rule Making Question
From: "Joel Esler \(jesler\) via Snort-sigs" <snort-sigs () lists snort org>
Date: Tue, 12 Oct 2021 15:20:55 +0000
Rules are “positive” matches. You can look for the lack of something, but you must tell the rule to look for something. On Oct 11, 2021, at 08:52, EGD via Snort-sigs <snort-sigs () lists snort org<mailto:snort-sigs () lists snort org>> wrote: I am new to rule writing and wanted to know when using multiple "content" tags and "pcre" tags if they are conditional. In other words, do they trigger if all of them get found true or if at least one does. i.e. content: "username"; content: "| 4c 55 6d|"; pcre "^[wW]hat[ .-]?[eE]ver$" would the rule trigger is only one of the above examples is true or if all - bonus question, could I make it conditional within the rule? Sent with ProtonMail<https://protonmail.com/> Secure Email. _______________________________________________ Snort-sigs mailing list Snort-sigs () lists snort org<mailto:Snort-sigs () lists snort org> https://lists.snort.org/mailman/listinfo/snort-sigs Please visit http://blog.snort.org for the latest news about Snort! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette Visit the Snort.org to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a href=" https://snort.org/downloads/#rule-downloads">emerging threats</a>!
_______________________________________________ Snort-sigs mailing list Snort-sigs () lists snort org https://lists.snort.org/mailman/listinfo/snort-sigs Please visit http://blog.snort.org for the latest news about Snort! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette Visit the Snort.org to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a href=" https://snort.org/downloads/#rule-downloads">emerging threats</a>!
Current thread:
- Rule Making Question EGD via Snort-sigs (Oct 12)
- Re: Rule Making Question Joel Esler (jesler) via Snort-sigs (Oct 12)
- Re: Rule Making Question Alex Tatistcheff via Snort-sigs (Oct 14)