How to map MITRE tags to NIDS rules

[IamTenacious]

Hi, I wanna know how can I map MITRE tags to NIDS rules(snort, suricata and zeek)

[johnununu]

https://docs.securityonion.net/en/latest/managing-alerts.html?highlight=so-rule#so-rule

[IamTenacious]

Thank you.
I tried that but I am unable to see the MITRE tags in the 'HUNT' section of SO, where can I see that?

[weslambert]

If defined in a rule as a tag, the value will show up in tags. If defined in a rule as a key:value metadata pair, then it will be available in rule.metadata.mitre*

[IamTenacious]

Thank you so much!!!
can you also tell me how can I map MITRE tags in zeek's .intel file as well

[dougburks]

The Zeek Intel Framework format has several metadata fields:
https://docs.zeek.org/en/master/frameworks/intel.html

[IamTenacious]

Thank you!