A research on Suricata, Bro (now called Zeek), Snort, and Security Onion

Do some research on Suricata, Bro (now called Zeek), Snort, and Security Onion. What similarities did you observe in these tools and its functionality? Do you think one of these would perform better than another and if so, why or under what circumstance? How do you add a rule to the IDS? What happens once a rule has been triggered? What is the structure and syntax for, let’s say, a Snort rule? Provide an example of a Snort rule then explain what it is searching for in the network traffic.