|
|
|
|
@ -37,6 +37,8 @@ signature is emphasized below:
|
|
|
|
|
.. note:: The following characters must be escaped inside the msg:
|
|
|
|
|
``;`` ``\`` ``"``
|
|
|
|
|
|
|
|
|
|
.. _suricata-rules-sids:
|
|
|
|
|
|
|
|
|
|
sid (signature ID)
|
|
|
|
|
------------------
|
|
|
|
|
|
|
|
|
|
@ -57,8 +59,8 @@ Example of sid in a signature:
|
|
|
|
|
provided as the last keyword (or second-to-last if there is a ``rev``)
|
|
|
|
|
of the signature.
|
|
|
|
|
|
|
|
|
|
There are reserved ranges of sids, the reservations are recorded
|
|
|
|
|
at https://sidallocation.org/ .
|
|
|
|
|
**There are reserved ranges of sids, the reservations are recorded
|
|
|
|
|
at https://sidallocation.org/ .**
|
|
|
|
|
|
|
|
|
|
.. Note::
|
|
|
|
|
|
|
|
|
|
@ -69,6 +71,16 @@ Example of sid in a signature:
|
|
|
|
|
<https://redmine.openinfosecfoundation.org/issues/5447>`_), it is advisable
|
|
|
|
|
to opt for a completely unique ``sid`` altogether.
|
|
|
|
|
|
|
|
|
|
Suricata Engine Events Rules SID range
|
|
|
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
|
|
|
|
|
|
Suricata provides signatures for engine events, bundled in the `rules`
|
|
|
|
|
folder, in the `suricata` directory/repository.
|
|
|
|
|
The full signature ID range for such rules is: 2200000 - 2299999.
|
|
|
|
|
|
|
|
|
|
These sid ranges can be seen in the `rules README file
|
|
|
|
|
<https://github.com/OISF/suricata/blob/main/rules/README.md>`_).
|
|
|
|
|
|
|
|
|
|
rev (revision)
|
|
|
|
|
--------------
|
|
|
|
|
|
|
|
|
|
|