New Rule Types in Snort 3

Snort 3 introduces three new rule types to simplify and enhance rule writing: service rules, file rules, and file identification rules.

Service and file rules allow for the creation of cleaner-looking rules that are service-specific and service-agnostic, respectively, while file identification rules use the new file_meta rule option to perform file type identification.

Each of these new rule types are created using a unique rule header, and more info about each can be found in the subsequent chapters.