Node: Editing Existing Signatures, Next: Importing Snort Signatures, Previous: Add a New Signature, Up: Signatures
Bro supplied signatures are in $BROHOME/sigs. You should not edit these, as they will get overwritten when you update Bro. Instead, make your modifications in $BROHOME/site. If you use the same signature ID as an existing signature, the site sig will take precedence.