The Investigation Insights – Snort Sig integration looks up any Snort signature that an analyst comes by and quickly link back to documentation related to that signature. Enabling analysts to always have quick context around the signature.
Snort rules are a key component of the Snort intrusion detection and prevention system. They define the actions to be taken upon matching network traffic and consist of two main sections: the rule header and the rule body. The rule header specifies the action, protocols, network addresses, port numbers, and direction of traffic that the rule applies to.
The rule body defines the message associated with the rule and the criteria that need to be met for a rule to match, including payload and non-payload conditions.
Integrated Dataminr Products
Investigation Insights
Snort-Sig with Investigation Insights
Looking for Integration Not Shown
