Forest Global Training Partners

Cyber Risks · Cisco Talos

Syntax Checking your Snort Rules

Summary: Cisco Talos describes dumbpig, a tool written in Perl by a contributor named Leon that checks Snort rules and reports what is wrong with them and what to do about it. The post shows sample output from checking an actual VRT rules file, which passed, and from checking another party's rules, which did not.

What's compelling: For teams that write their own Snort rules, a rule that fails to do what its author intended leaves detection gaps that only surface when the rule is tested or when an intrusion goes unnoticed.

Read the original at Cisco Talos ↗

Topics
Malware
Related