cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
615
Views
0
Helpful
1
Replies
Beginner

Uploading own snort rules

Hi,

 

I have a requirement to upload the below snort rule to my sourcefire platform:

 

any any -> any any (msg:"Malicious SSL 01 Detected"; content:"17 03 01 00 08|"; pcre:/\x17\x03\x01\x00\x08.{4}\x04\x88\x4d\x76/"; sid:9999998;)

 

However I keep getting an error message that I cannot seem to fix, I have attached the error.

 

Snort.PNG

 

Thanks

Everyone's tags (4)
1 REPLY 1
Highlighted
Beginner

Re: Uploading own snort rules

Copied the rule wrong onto here, the rule is:

 

alert tcp any any -> any any (msg:"Malicious SSL 01 Detected"; content:"|17 03 01 00 08|"; pcre:"/\x17\x03\x01\x00\x08.{4}\x04\x88\x4d\x76/"; rev:1; sid:9999998;)

 

Thanks

CreatePlease to create content
Content for Community-Ad
FusionCharts will render here