Index and show rules

[jasonish]

Index and show rules

[jasonish]

Should be doable soon. I've had a Golang rule parser sitting around for sometime now not in version control. Sounds like a good idea for the "agent" feature I've been prototyping, which would make this work even if the sensor is on a different machine.

[rhaist]

I have also been experimenting with a golang rule parser. Let me know if you need some help/ideas.

[jasonish]

If interested, here's my go parser: https://github.com/jasonish/go-idsrules

It doesn't go so far as to validate that rules will actually run, it currently only looks at syntax.

[rhaist]

Looks very nice. I will have a look and watch for stuff that I can contribute from my implementation.

I see from tests that you have solved a problem of mine. Am I right, that suricata does in fact allow spaces in the address lists in the net part of the rule contrary to snort?

[jasonish]

I see from tests that you have solved a problem of mine. Am I right, that suricata does in fact allow spaces in the address lists in the net part of the rule contrary to snort?

I actually haven't checked Suricata, and my parser doesn't either - the test is to make sure that they fail. Currently I still want to parse valid Snort rules as well. If Suricata can (I should check) then I'll have to go a little farther where you can set a parser flavour.

[jasonish]

Edit in last comment.. I haven't checked Suricata yet for allowing spaces.

[rhaist]

I checked - suricata does allow blanks for net and port definitions.

[jasonish]

It might not help in your use case, but there are now ways to include the rule with the alert...

The evebox server (if also reading events), the evebox agent as well as esimport can all parse a directory of Snort rules and add the rule to the event.

This doesn't help if you are using Logstash/Filebeat or other tools to handle your logs though, so I'll leave this open for now.

[jasonish]

Closing for now. As mentioned above the EveBox log readers can also parse rules and add them to events. In the future, Suricata may also include the rule with an alert.