Fortinet black logo

Importing Snort signature files

7.0.2
Copy Link
Copy Doc ID 4e388918-8ddc-11ec-9fd1-fa163e15d75b:385064
Download PDF

Importing Snort signature files

Use the IPS Custom Signature module to import Snort signature files directly into FortiSigConverter MEA. After the signatures are converted to supported IPS signatures, you can use FortiSigConverter MEA to push the signature rules to FortiManager.

Tooltip

When ADOMs are enabled in FortiManager 7.0.2 and later, you must select the correct ADOM before you import Snort signature files into FortiSigConverter MEA. Because FortiSigConverter MEA is unique in each ADOM, the converted signature rules are only available for use in the same ADOM. If you want to use the same Snort signatures in two or more ADOMs, you must import the Snort signatures into the FortiSigConverter MEA in each ADOM where you want to use the converted signature rules.

To import a Snort signature file:
  1. Go to IPS Custom Signature, and click Import SNORT Signature.

    The Import SNORT Signature dialog box is displayed.

  2. Click Browse to locate the Snort signature file, and then click Open.

    Alternately, you can drag and drop the Snort signature file on to the dialog box.

    The selected Snort signature file is displayed in the Import SNORT Signature dialog box.

  3. Click OK.

    The import process starts, and a progress bar is displayed.

    When the progress reaches 100%, status information about the import process is displayed.

  4. Click OK to complete the import process.

    The list of converted signatures is displayed. The Conversion Status column displays the status of each converted rule.

Importing Snort signature files

Use the IPS Custom Signature module to import Snort signature files directly into FortiSigConverter MEA. After the signatures are converted to supported IPS signatures, you can use FortiSigConverter MEA to push the signature rules to FortiManager.

Tooltip

When ADOMs are enabled in FortiManager 7.0.2 and later, you must select the correct ADOM before you import Snort signature files into FortiSigConverter MEA. Because FortiSigConverter MEA is unique in each ADOM, the converted signature rules are only available for use in the same ADOM. If you want to use the same Snort signatures in two or more ADOMs, you must import the Snort signatures into the FortiSigConverter MEA in each ADOM where you want to use the converted signature rules.

To import a Snort signature file:
  1. Go to IPS Custom Signature, and click Import SNORT Signature.

    The Import SNORT Signature dialog box is displayed.

  2. Click Browse to locate the Snort signature file, and then click Open.

    Alternately, you can drag and drop the Snort signature file on to the dialog box.

    The selected Snort signature file is displayed in the Import SNORT Signature dialog box.

  3. Click OK.

    The import process starts, and a progress bar is displayed.

    When the progress reaches 100%, status information about the import process is displayed.

  4. Click OK to complete the import process.

    The list of converted signatures is displayed. The Conversion Status column displays the status of each converted rule.