Create Snort Rule File to Import to Checkpoint IPS

ESpataro — Thu, 26 Jan 2023 10:39:18 GMT

Hi ,

I have been provided an excel.csv file which contains snort definitions and been asked to import them into checkpoint IPS. However I see that checkpoint needs a snort rules file in order to be able to import the definitions and add them. has anybody come across a toll that will convert the csv file to a snort rules file so it can be imported . csv file attached

Thanks

Enzo

Re: Create Snort Rule File to Import to Checkpoint IPS

G_W_Albrecht — Thu, 26 Jan 2023 11:18:24 GMT

I can see no snort definitions here, only a listing - a Snort rule looks like this:

<Action> <Protocol> <Source IP Address> <Source Port> <Direction>
<Destination IP Address> <Destination Port> (msg:"<Text>";
<Keyword>:"<Option>";)

But you only have a list of threats and signatures, not snort definitions/signatures itself, with the columns:

Threat ID
Threat Name
Severity
Release Date
Signature ID
Signature Name

It is not possible to convert this into snort rules...

topic Re: Create Snort Rule File to Import to Checkpoint IPS in General Topics

Create Snort Rule File to Import to Checkpoint IPS

Re: Create Snort Rule File to Import to Checkpoint IPS