Alert invalid number of options, command not found

Help
1

Suricata 7.0.2
Ubuntu 22.04
Installed from PPA

When running

alert ip any any -> any any \(msg:"GPL ATTACK_RESPONSE id check returned root"; content:"uid=0|28|root|29|"; classtype:bad-unknown; sid:2100498; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;\)

there is the following problem:

Invalid number of options.
content:uid=0|28|root|29|: command not found
classtype:bad-unknown: command not found
sid:2100498: command not found
rev:7: command not found
metadata:created_at: command not found
): command not found

How to fix?

2

I think the \ before in \(msg:" and \) at the end are probably messing this up.

Can you try removing those and seeing what happens? If that works, then the issue is how/why are those getting in the rule. What ruleset manager are you using?

3

With the \ removed there is a different problem:

alert ip any any -> any any (msg:"GPL ATTACK_RESPONSE id check returned root"; content:"uid=0|28|root|29|"; classtype:bad-unknown; sid:2100498; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;)
bash: syntax error near unexpected token `('
4

You need to have this in a rule file and not write the command in the bash shell