: What’s New in the IPS Signature Converter Plugin 1.0.5
Focus
Focus

What’s New in the IPS Signature Converter Plugin 1.0.5

Table of Contents

What’s New in the IPS Signature Converter Plugin 1.0.5

Learn about the enhancements in the IPS Signature Converter plugin 1.0.5
The IPS signature converter version 1.0.5 introduces the following capabilities:
FeatureDescription
Support for Snort HTTP Sticky BuffersWhen you convert Snort rules, the IPS Signature Converter now treats HTTP buffers, such as http_uri, http_header, and http_client_body, as sticky so that the buffer only needs to appear once for it to be applied to every content pattern after the modifier in the signature.
Snort 3 Style SupportYou can now convert Snort rules that have commas separating content patterns and their associated suboption. Example:
alert http $EXTERNAL_NET any -> $HOME_NET any ( msg:"test snort rule"; flow:to_server,established; content:"testing1", nocase; content:"testing2", distance 20, within 50; sid:00001; rev:1;)