Did you include your signature file in local.bro file, with *@load-sigs <name-of-the-sig-file>*? Thanks, Fatema. -------------- next part -------------- An HTML attachment was scrubbed... URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20180206/b1abe5cf/attachment.html