suricata_check.utils.regex
==========================

.. py:module:: suricata_check.utils.regex

.. autoapi-nested-parse::

   The `suricata_check.utils.regex` module contains regular expressions for matching various parts of rules.



Attributes
----------

.. autoapisummary::

   suricata_check.utils.regex.ADDRESS_GROUPS
   suricata_check.utils.regex.ALL_DETECTION_KEYWORDS
   suricata_check.utils.regex.ALL_KEYWORDS
   suricata_check.utils.regex.ALL_METADATA_KEYWORDS
   suricata_check.utils.regex.ALL_MODIFIER_KEYWORDS
   suricata_check.utils.regex.ALL_TRANSFORMATION_KEYWORDS
   suricata_check.utils.regex.ALL_VARIABLES
   suricata_check.utils.regex.APP_LAYER_KEYWORDS
   suricata_check.utils.regex.BASE64_BUFFER_KEYWORDS
   suricata_check.utils.regex.BASE64_TRANSFORMATION_KEYWORDS
   suricata_check.utils.regex.BUFFER_KEYWORDS
   suricata_check.utils.regex.CLASSTYPES
   suricata_check.utils.regex.COMPATIBILITY_MODIFIER_KEYWORDS
   suricata_check.utils.regex.CONTENT_KEYWORDS
   suricata_check.utils.regex.DCERPC_SPECIFIC_KEYWORDS
   suricata_check.utils.regex.DNS_SPECIFIC_KEYWORDS
   suricata_check.utils.regex.FLOW_KEYWORDS
   suricata_check.utils.regex.FLOW_OPTIONS
   suricata_check.utils.regex.FLOW_STREAM_KEYWORDS
   suricata_check.utils.regex.FTP_KEYWORDS
   suricata_check.utils.regex.HEADER_REGEX
   suricata_check.utils.regex.HTTP_SPECIFIC_KEYWORDS
   suricata_check.utils.regex.ICMP_SPECIFIC_KEYWORDS
   suricata_check.utils.regex.IP_ADDRESS_REGEX
   suricata_check.utils.regex.IP_SPECIFIC_KEYWORDS
   suricata_check.utils.regex.JA3_JA4_KEYWORDS
   suricata_check.utils.regex.LRU_CACHE_SIZE
   suricata_check.utils.regex.LUA_KEYWORDS
   suricata_check.utils.regex.MATCH_LOCATION_KEYWORDS
   suricata_check.utils.regex.METADATA_DATE_KEYWORDS
   suricata_check.utils.regex.METADATA_NON_DATE_KEYWORDS
   suricata_check.utils.regex.MODIFIER_KEYWORDS
   suricata_check.utils.regex.NON_FUNCTIONAL_KEYWORDS
   suricata_check.utils.regex.OTHER_BUFFERS
   suricata_check.utils.regex.OTHER_KEYWORDS
   suricata_check.utils.regex.OTHER_PAYLOAD_KEYWORDS
   suricata_check.utils.regex.PERFORMANCE_DETECTION_OPTIONS
   suricata_check.utils.regex.POINTER_MOVEMENT_KEYWORDS
   suricata_check.utils.regex.PORT_GROUPS
   suricata_check.utils.regex.PROTOCOL_SPECIFIC_KEYWORDS
   suricata_check.utils.regex.SIZE_KEYWORDS
   suricata_check.utils.regex.SSH_SPECIFIC_KEYWORDS
   suricata_check.utils.regex.STATEFUL_KEYWORDS
   suricata_check.utils.regex.STICKY_BUFFER_NAMING
   suricata_check.utils.regex.STREAM_KEYWORDS
   suricata_check.utils.regex.SURICATA_CHECK_METADATA_KEYWORDS
   suricata_check.utils.regex.TCP_SPECIFIC_KEYWORDS
   suricata_check.utils.regex.THRESHOLD_KEYWORDS
   suricata_check.utils.regex.TLS_SPECIFIC_KEYWORDS
   suricata_check.utils.regex.TRANSFORMATION_KEYWORDS
   suricata_check.utils.regex.UDP_SPECIFIC_KEYWORDS


Functions
---------

.. autoapisummary::

   suricata_check.utils.regex.get_options_regex
   suricata_check.utils.regex.get_rule_body
   suricata_check.utils.regex.get_rule_group_entries
   suricata_check.utils.regex.get_variable_groups
   suricata_check.utils.regex.is_valid_rule


Module Contents
---------------

.. py:function:: get_options_regex(options: collections.abc.Iterable[str]) -> suricata_check.utils.regex_provider.Pattern

   Returns a regular expression that can match any of the provided options.


.. py:function:: get_rule_body(rule: suricata_check.utils.rule.Rule) -> str

   Returns the body of a rule.


.. py:function:: get_rule_group_entries(group: str) -> collections.abc.Sequence[str]

   Returns a list of entries in a group.


.. py:function:: get_variable_groups(value: str) -> collections.abc.Sequence[str]

   Returns a list of variable groups such as $HTTP_SERVERS in a variable.


.. py:function:: is_valid_rule(rule: suricata_check.utils.rule.Rule) -> bool

   Checks if a rule is valid.


.. py:data:: ADDRESS_GROUPS
   :value: ('HOME_NET', 'EXTERNAL_NET', 'HTTP_SERVERS', 'SMTP_SERVERS', 'SQL_SERVERS', 'DNS_SERVERS',...


.. py:data:: ALL_DETECTION_KEYWORDS
   :type:  collections.abc.Sequence[str]

.. py:data:: ALL_KEYWORDS

.. py:data:: ALL_METADATA_KEYWORDS

.. py:data:: ALL_MODIFIER_KEYWORDS
   :type:  collections.abc.Sequence[str]

.. py:data:: ALL_TRANSFORMATION_KEYWORDS
   :type:  collections.abc.Sequence[str]

.. py:data:: ALL_VARIABLES
   :value: ('HOME_NET', 'EXTERNAL_NET', 'HTTP_SERVERS', 'SMTP_SERVERS', 'SQL_SERVERS', 'DNS_SERVERS',...


.. py:data:: APP_LAYER_KEYWORDS
   :value: ('app-layer-event', 'app-layer-protocol')


.. py:data:: BASE64_BUFFER_KEYWORDS
   :value: ('base64_data',)


.. py:data:: BASE64_TRANSFORMATION_KEYWORDS
   :value: ('base64_decode',)


.. py:data:: BUFFER_KEYWORDS
   :type:  collections.abc.Sequence[str]

.. py:data:: CLASSTYPES
   :value: ('not-suspicious', 'unknown', 'bad-unknown', 'attempted-recon', 'successful-recon-limited',...


.. py:data:: COMPATIBILITY_MODIFIER_KEYWORDS
   :value: ('rawbytes',)


.. py:data:: CONTENT_KEYWORDS
   :value: ('content', 'pcre')


.. py:data:: DCERPC_SPECIFIC_KEYWORDS
   :value: ('dce.iface', 'dce.opnum', 'dce.stub_data', 'dce_iface', 'dce_opnum', 'dce_stub_data')


.. py:data:: DNS_SPECIFIC_KEYWORDS
   :value: ('dns.opcode', 'dns.query', 'dns_query')


.. py:data:: FLOW_KEYWORDS
   :value: ('flow', 'flow.age', 'flowint')


.. py:data:: FLOW_OPTIONS
   :type:  collections.abc.Sequence[str]
   :value: ('to_client', 'to_server', 'from_client', 'from_server', 'established', 'not_established',...


.. py:data:: FLOW_STREAM_KEYWORDS
   :type:  collections.abc.Sequence[str]

.. py:data:: FTP_KEYWORDS
   :value: ('ftpbounce', 'ftpdata_command')


.. py:data:: HEADER_REGEX

.. py:data:: HTTP_SPECIFIC_KEYWORDS
   :value: ('file.data', 'file_data', 'http.accept', 'http.accept_enc', 'http.accept_lang',...


.. py:data:: ICMP_SPECIFIC_KEYWORDS
   :value: ('fragbits', 'icode', 'icmp_id', 'icmp_seq', 'itype')


.. py:data:: IP_ADDRESS_REGEX

.. py:data:: IP_SPECIFIC_KEYWORDS
   :value: ('ip_proto', 'ttl')


.. py:data:: JA3_JA4_KEYWORDS
   :value: ('ja3.hash', 'ja3_hash', 'ja3.string', 'ja3s.hash')


.. py:data:: LRU_CACHE_SIZE
   :value: 10


.. py:data:: LUA_KEYWORDS
   :value: ('lua', 'luajit')


.. py:data:: MATCH_LOCATION_KEYWORDS
   :value: ('endswith', 'startswith')


.. py:data:: METADATA_DATE_KEYWORDS
   :value: ('created_at', 'reviewed_at', 'updated_at')


.. py:data:: METADATA_NON_DATE_KEYWORDS
   :value: ('affected_product', 'attack_target', 'confidence', 'cve', 'deprecation_reason', 'deployment',...


.. py:data:: MODIFIER_KEYWORDS
   :value: ('nocase',)


.. py:data:: NON_FUNCTIONAL_KEYWORDS
   :value: ('classtype', 'gid', 'metadata', 'msg', 'priority', 'reference', 'rev', 'sid', 'target')


.. py:data:: OTHER_BUFFERS
   :value: ('http.location', 'http.request_header', 'http.response_header', 'http.server', 'ja3s.hash',...


.. py:data:: OTHER_KEYWORDS
   :value: ('noalert', 'tag')


.. py:data:: OTHER_PAYLOAD_KEYWORDS
   :value: ('byte_extract', 'byte_jump', 'byte_test', 'isdataat')


.. py:data:: PERFORMANCE_DETECTION_OPTIONS
   :value: ('fast_pattern',)


.. py:data:: POINTER_MOVEMENT_KEYWORDS
   :value: ('depth', 'distance', 'offset', 'pkt_data', 'within')


.. py:data:: PORT_GROUPS
   :value: ('HTTP_PORTS', 'SHELLCODE_PORTS', 'ORACLE_PORTS', 'SSH_PORTS', 'DNP3_PORTS', 'MODBUS_PORTS',...


.. py:data:: PROTOCOL_SPECIFIC_KEYWORDS

.. py:data:: SIZE_KEYWORDS
   :value: ('bsize', 'dsize')


.. py:data:: SSH_SPECIFIC_KEYWORDS
   :value: ('ssh_proto',)


.. py:data:: STATEFUL_KEYWORDS
   :value: ('flowbits', 'flowint', 'xbits')


.. py:data:: STICKY_BUFFER_NAMING

.. py:data:: STREAM_KEYWORDS
   :value: ('stream_size',)


.. py:data:: SURICATA_CHECK_METADATA_KEYWORDS
   :value: ('suricata-check',)


.. py:data:: TCP_SPECIFIC_KEYWORDS
   :value: ('ack', 'flags', 'seq', 'tcp.flags', 'tcp.hdr')


.. py:data:: THRESHOLD_KEYWORDS
   :value: ('detection_filter', 'threshold')


.. py:data:: TLS_SPECIFIC_KEYWORDS
   :value: ('ssl_version', 'ssl_state', 'tls.cert_fingerprint', 'tls.cert_issuer', 'tls.cert_serial',...


.. py:data:: TRANSFORMATION_KEYWORDS
   :value: ('compress_whitespace', 'dotprefix', 'header_lowercase', 'pcrexform', 'strip_pseudo_headers',...


.. py:data:: UDP_SPECIFIC_KEYWORDS
   :value: ('udp.hdr',)