@ -7,32 +7,28 @@ Meta-settings have no effect on Suricata's inspection; they do have an effect on
msg (message)
-------------
The keyword msg gives textual information about the signature and the possible alert.
The keyword msg gives more information about the signature and the possible alert. The first part shows the class of the signature. It is a convention that part is written in uppercase
characters.
The format of msg is:
::
The format of msg is::
msg: "some description";
Examples:
::
Examples::
msg:"ATTACK-RESPONSES 403 Forbidden";
msg:"ET EXPLOIT SMB-DS DCERPC PnP bind attempt";
It is a convention that msg is always the first keyword of a signature.
Another example of msg in a signature:
To continue the example of the previous chapter, this is the keyword in action in an actual rule:
..container:: example-rule
drop tcp $HOME_NET any -> $EXTERNAL_NET any (:example-rule-emphasis:`msg:"ET TROJAN Likely Bot Nick in IRC (USA +..)";` flow:established,to_server; flowbits:isset,is_proto_irc; content:"NICK "; pcre:"/NICK .*USA.*[0-9]{3,}/i"; reference:url,doc.emergingthreats.net/2008124; classtype:trojan-activity; sid:2008124; rev:2;)
In this example the red, bold-faced part is the msg.
..tip::
It is convention to make the first part of the signature uppercase and show the class of the signature.
It is also convention that ``msg`` is made the first keyword in the signature.
..note:: The following characters must be escaped inside the msg:
``;````\````"``
@ -40,11 +36,7 @@ In this example the red, bold-faced part is the msg.
sid (signature ID)
------------------
The keyword sid gives every signature its own id. This id is stated with a number.
The format of sid is:
::
The keyword sid gives every signature its own id. This id is stated with a number. The format of sid is::
sid:123;
@ -54,22 +46,19 @@ Example of sid in a signature:
drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Likely Bot Nick in IRC (USA +..)"; flow:established,to_server; flowbits:isset,is_proto_irc; content:"NICK "; pcre:"/NICK .*USA.*[0-9]{3,}/i"; reference:url,doc.emergingthreats.net/2008124; classtype:trojan-activity; :example-rule-emphasis:`sid:2008124;` rev:2;)
In this example the red, bold-faced part is the sid.
..tip::
rev (Revision)
--------------
It is convention that the signature ``sid`` is provided as the last keyword (or second-to-last if there is a ``rev``) of the signature.
rev (revision)
--------------
The sid keyword is almost every time accompanied by rev. Rev
represents the version of the signature. If a signature is modified,
the number of rev will be incremented by the signature writers. The
format of rev is:
::
format of rev is::
rev:123;
*It is a convention that sid comes before rev, and both are the last
of all keywords.*
Example of rev in a signature:
@ -77,44 +66,44 @@ Example of rev in a signature:
drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Likely Bot Nick in IRC (USA +..)"; flow:established,to_server; flowbits:isset,is_proto_irc; content:"NICK "; pcre:"/NICK .*USA.*[0-9]{3,}/i"; reference:url,doc.emergingthreats.net/2008124; classtype:trojan-activity; sid:2008124; :example-rule-emphasis:`rev:2;`)
In this example the red, bold-faced part is the rev.
..tip::
It is a convention that sid comes before rev, and both are the last
of all keywords.
gid (group ID)
--------------
The gid keyword can be used to give different groups of signatures
another id value (like in sid). Suricata uses by default gid 1. It is
possible to modify this. It is not usual that it will be changed, and
changing it has no technical implications. You can only notice it in
the alert.
Example of gid in a signature:
Example of gid in an alert of fast.log. In the part [1:2008124:2], 1 is the gid (2008124 is the the sid and 2 the rev).
..container:: example-rule
10/15/09-03:30:10.219671 [**] [:example-rule-emphasis:`1`:2008124:2] ET TROJAN Likely Bot Nick in IRC (USA +..) [**] [Classification: A Network Trojan was Detected]
Ralph Broenink
7 years ago
committed by
Victor Julien