[Bro] About bro signature reg exp

[Robin Sommer]

On Wed, Aug 01, 2018 at 17:41 +0900, Marchisio Claudio wrote:

> So I want to use multiline search in bro-signature like pcre 

Bro doesn't treat line breaks any special, you can just match against
them with \r and/or \n. Try somethng like this:

    payload /(|.*[\r\n])Cache/

Robin

-- 
Robin Sommer * Corelight, Inc. * robin at corelight.com * www.corelight.com