: What’s New in the IPS Signature Converter Plugin 2.0.1
Focus
Focus

What’s New in the IPS Signature Converter Plugin 2.0.1

Table of Contents

What’s New in the IPS Signature Converter Plugin 2.0.1

Learn about the enhancements in the IPS Signature Converter plugin 2.0.1
The IPS signature converter version 2.0.1 introduces the following capabilities:
Feature
Description
Support for Snort HTTP Sticky Buffers
When you convert Snort rules, the IPS Signature Converter now treats HTTP buffers, such as
http_uri
,
http_header
, and
http_client_body
, as sticky so that the buffer only needs to appear once for it to be applied to every content pattern after the modifier in the signature.
Snort 3 Style Support
You can now convert Snort rules that have commas separating content patterns and their associated suboption. Example:
alert http $EXTERNAL_NET any -> $HOME_NET any ( msg:"test snort rule"; flow:to_server,established; content:"testing1", nocase; content:"testing2", distance 20, within 50; sid:00001; rev:1;)

Recommended For You