I would like the ability to look at Snort rules that were written in specific date ranges only given a collection of .rules files from either Sourcefire or Emerging Threats. Is this possible?


These sources do not necessarily include any sort of "date stamp" in the rules though such information could be included in the msg field of the rule options. You may notice some URLs in the reference field contain dates but this info is not going to be populated sufficiently to rely upon it. I don't know of any sites/systems/tools that may help and the only suggestion I have is painful...

Starting with the earliest rules you want to evaluate and working up the latest rules, essentially you want to diff from one version of the file to the next which would yield when rules was added/updated/deleted.

Not the answer you're looking for? Browse other questions tagged or ask your own question.