Errors in suricata rules

Rules
,
4

Not sure what happened but when I tried your rule, there are a bunch of issues:

  1. unicode characters in rule language like →
  2. broken variables $EXTE RNAL (there should be no space)
  3. http_raw_cookie, there is no keyword like that in Suricata. ref: 6.12. HTTP Keywords — Suricata 6.0.5 documentation

Are you sure that it’s a Suricata rule?

I don’t think this rule is ET at all. Ref: https://doc.emergingthreats.net/bin/view/Main/SidAllocation

Let us know if it doesn’t help determine the issue.

1 Like