2

I would like the ability to look at Snort rules that were written in specific date ranges only given a collection of .rules files from either Sourcefire or Emerging Threats. Is this possible?

closed as off-topic by schroeder, M'vy, NULLZ, Rory Alsop Feb 28 '15 at 17:26

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – schroeder, M'vy, NULLZ, Rory Alsop
If this question can be reworded to fit the rules in the help center, please edit the question.

0

These sources do not necessarily include any sort of "date stamp" in the rules though such information could be included in the msg field of the rule options. You may notice some URLs in the reference field contain dates but this info is not going to be populated sufficiently to rely upon it. I don't know of any sites/systems/tools that may help and the only suggestion I have is painful...

Starting with the earliest rules you want to evaluate and working up the latest rules, essentially you want to diff from one version of the file to the next which would yield when rules was added/updated/deleted.

Not the answer you're looking for? Browse other questions tagged or ask your own question.