Snort is an open source network intrusion prevention and detection system (IDS/IPS) developed by Sourcefire.
Combining the benefits of signature, protocol, and anomaly-based inspection, Snort is the most widely deployed IDS/IPS technology worldwide.
With millions of downloads and nearly 400,000 registered users, Snort has become the de facto standard for IPS.
GNU Emacs is an extensible, customizable text editor—and more. At its core is an interpreter for Emacs Lisp, a dialect of the Lisp programming language with extensions to support text editing.
Support for syntax highlighting, commenting and indentation.
Validate the syntax of the current file with snort-validate and test it against a
PCAP-file with snort-test-pcap.
Jump between rules with snort-next-rule and snort-previous-rule. Kill the rule at the point with snort-kill-rule.
Variables are in the snort group.
snort-basic-offset: the indentation levelsnort-executable: path to the Snort executable
- Remove word lists when regexp are created (free memory?)
- Does not support user created rule actions (dynamically?)
- Variable modifiers
- Extend the syntax table
snort-expand,snort-contract,snort-expand-all,snort-contract-all: toggle between one-line and multiline rules (one modifier per line)snort-create-rule: create skeleton for common rules (e.g. dns query, http-requests, ping)