Snort mailing list archives

Rule Making Question


From: EGD via Snort-sigs <snort-sigs () lists snort org>
Date: Mon, 11 Oct 2021 12:52:14 +0000

I am new to rule writing and wanted to know when using multiple "content" tags and "pcre" tags if they are conditional. 
In other words, do they trigger if all of them get found true or if at least one does.

i.e. content: "username"; content: "| 4c 55 6d|"; pcre "^[wW]hat[ .-]?[eE]ver$"

would the rule trigger is only one of the above examples is true or if all - bonus question, could I make it 
conditional within the rule?

Sent with [ProtonMail](https://protonmail.com/) Secure Email.
_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists snort org
https://lists.snort.org/mailman/listinfo/snort-sigs

Please visit http://blog.snort.org for the latest news about Snort!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

Visit the Snort.org to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a 
href=" https://snort.org/downloads/#rule-downloads";>emerging threats</a>!

Current thread: