@bmeeks Hello, how to resolve this errors (using snort rules on suricata) , its example have a lot like this
[100508 - Suricata-Main] 2024-04-29 00:59:33 Error: detect: error parsing signature "drop tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"SERVER-WEBAPP Ivanti multiple products server side request forgery attempt"; flow:to_server,established; content:"SAMLResponse="; nocase; http_uri; base64_decode:bytes 1000,relative; base64_data; content:"RetrievalMethod"; nocase; content:"URI"; nocase; pcre:"/RetrievalMethod[^>]?\sURI\s=/i"; content:"/dana-na/auth/saml"; fast_pattern:only; http_uri; metadata:policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:cve,2024-21893; reference:url,forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways; classtype:web-application-attack; sid:63099; rev:1;)" from file /usr/local/etc/suricata/suricata_40578_igc2/rules/suricata.rules at line 14962
[100508 - Suricata-Main] 2024-04-29 00:59:31 Error: detect: previous sticky buffer has no matches
and this
[100508 - Suricata-Main] 2024-04-29 00:59:34 Warning: detect-flowbits: flowbit 'file.zip&file.silverlight' is checked but not set. Checked in 28582 and 2 other sigs
[100508 - Suricata-Main] 2024-04-29 00:59:34 Warning: detect-flowbits: flowbit 'file.pdf&file.ttf' is checked but not set. Checked in 28585 and 1 other sigs
[100508 - Suricata-Main] 2024-04-29 00:59:34 Warning: detect-flowbits: flowbit 'file.xls&file.ole' is checked but not set. Checked in 30990 and 1 other sigs
[100508 - Suricata-Main] 2024-04-29 00:59:34 Warning: detect-flowbits: flowbit 'file.onenote' is checked but not set. Checked in 61666 and 1 other sigs
Here a thousands of rules, how to even found by number?
as i know exist special soft to resolve this typical errors but how and could be not free of charge
At the end have also
[100508 - Suricata-Main] 2024-04-29 00:59:34 Info: detect: 2 rule files processed. 15356 rules successfully loaded, 34 rules failed, 0
[100508 - Suricata-Main] 2024-04-29 00:59:34 Info: threshold-config: Threshold config parsed: 0 rule(s) found
[100508 - Suricata-Main] 2024-04-29 00:59:34 Info: detect: 15356 signatures processed. 14 are IP-only rules, 1025 are inspecting packet payload, 7986 inspect application layer, 0 are decoder event only