As we weren’t able to answer all questions asked during the awesome webinar Tatyana Shishkova presented on writing Suricata Rules, we decided to bring such questions to the forum, so they can still have an answer.
I’ll share each question and answer pair as a different reply. All the answers have been provided by members of the OISF team.
Edit: I will update this post with the link to the webinar recording, as soon as it has been published!
Edit II: In case you’ve missed the webinar, or you would like to rewatch it, you can find it now on our YouTube channel: Webinar - An Introduction to Writing Suricata Rules with Tatyana Shishkova - YouTube
Feel free to ask follow-up questions here, if anything is unclear!