Package: base/frameworks/signatures
The signature framework provides for doing low-level pattern matching. While signatures are not Zeek’s preferred detection tool, they sometimes come in handy and are closer to what many people are familiar with from using other NIDS.
base/frameworks/signatures/__load__.zeek
base/frameworks/signatures/main.zeek
Script level signature support. See the signature documentation for more information about Zeek’s signature engine.