Snort Major Mode for Emacs
Combining the benefits of signature, protocol, and anomaly-based inspection, Snort is the most widely deployed IDS/IPS technology worldwide.
With millions of downloads and nearly 400,000 registered users, Snort has become the de facto standard for IPS.
GNU Emacs is an extensible, customizable text editor—and more. At its core is an interpreter for Emacs Lisp, a dialect of the Lisp programming language with extensions to support text editing.
Support for syntax highlighting, commenting and indentation.
Validate the syntax of the current file with
snort-validate and test it against a
Jump between rules with
snort-previous-rule. Kill the rule at the point with
Variables are in the
snort-basic-offset: the indentation level
snort-executable: path to the Snort executable
- Remove word lists when regexp are created (free memory?)
- Does not support user created rule actions (dynamically?)
- Variable modifiers
- Extend the syntax table
snort-contract-all: toggle between one-line and multiline rules (one modifier per line)
snort-create-rule: create skeleton for common rules (e.g. dns query, http-requests, ping)