I would like the ability to look at Snort rules that were written in specific date ranges only given a collection of .rules files from either Sourcefire or Emerging Threats. Is this possible?
closed as off-topic by schroeder♦, M'vy, NULLZ, Rory Alsop♦ Feb 28 '15 at 17:26
This question appears to be off-topic. The users who voted to close gave this specific reason:
- "This question does not appear to be about Information security within the scope defined in the help center." – schroeder, M'vy, NULLZ, Rory Alsop
These sources do not necessarily include any sort of "date stamp" in the rules though such information could be included in the
msg field of the rule options. You may notice some URLs in the
reference field contain dates but this info is not going to be populated sufficiently to rely upon it. I don't know of any sites/systems/tools that may help and the only suggestion I have is painful...
Starting with the earliest rules you want to evaluate and working up the latest rules, essentially you want to diff from one version of the file to the next which would yield when rules was added/updated/deleted.