How are SNORT rules constructed?
A traditional Snort rule consists of a rule header followed by a parenthesized set of rule options. The header establishes the traffic and action criteria, while the options define the detailed matching conditions. Whitespace may be ignored by newer Snort versions, but the conventional rule syntax is a single logical line. Snort Rule Writing Guide: The Basics
Community Discussion