Writing Definitions » History » Version 3

Writing Definitions¶

NSIA supports two types of definitions:

ThreatScript	ThreatPattern
Written in ECMAScript / JavaScript	Written in a format similar to Snort
Somewhat complex to create	Simple and easy to create
Can auto-baseline tune itself	Cannot baseline itself (can only be disabled entirely)
Is stateful (remember things from previous scans)	Is stateless (cannot remember things from previous scans)
Are slower than ThreatSignatures	Are faster than ThreatScripts
Very flexible detection logic; can be used to detect nearly anything	Functionality limited to what regular expressions

Custom definitions must have an ID of 1000000 or more; only official definitions can have IDs of less than 1000000.

NSIA will parse definitions before they are saved in order to identify syntax and some semantic errors. Errors that are discovered during runtime are noted on the definition errors page (e.g. http://127.0.0.1:8080/Definitions/Errors) and in the event logs (e.g. http://127.0.0.1:8080/System/Eventlog).

ThreatScript definitions may be flagged as having an error if they fail to complete within 10 seconds (see ScriptDefinition.MAX_SCRIPT_RUNTIME).

Creating a ThreatSignature

Creating a ThreatScript