suricata_check.suricata_check

The suricata_check.suricata_check module contains the command line utility and the main program logic.

Functions

`analyze_rule`(...)	Checks a rule and returns a dictionary containing the rule and a list of issues found.
`get_ini_kwargs`(→ dict[str, Any])	Read configuration from INI file based on CLI_ARGUMENTS structure.
`main`(→ None)	The suricata-check command processes all rules inside a rules file and outputs a list of detected issues.
`process_rules_file`(...)	Processes a rule file and returns a list of rules and their issues.

Module Contents

suricata_check.suricata_check.analyze_rule(rule: suricata_check.utils.rule.Rule, checkers: collections.abc.Sequence[suricata_check.checkers.interface.CheckerInterface] | None = None, ignore: collections.abc.Sequence[str] | None = None) → suricata_check.utils.checker_typing.RuleReport[source]

Checks a rule and returns a dictionary containing the rule and a list of issues found.

Args: rule: The rule to be checked. checkers: The checkers to be used to check the rule. ignore: Regular expressions to match checker codes to ignore

Returns: A list of issues found in the rule. Each issue is typed as a dict.

Raises: InvalidRuleError: If the rule does not follow the Suricata syntax.

suricata_check.suricata_check.get_ini_kwargs(path: str | None) → dict[str, Any][source]: Read configuration from INI file based on CLI_ARGUMENTS structure.

suricata_check.suricata_check.main(**kwargs: dict[str, Any]) → None

The suricata-check command processes all rules inside a rules file and outputs a list of detected issues.

Raises:

BadParameter: If provided arguments are invalid.

RuntimeError: If no checkers could be automatically discovered.

suricata_check.suricata_check.process_rules_file(rules: str, evaluate_disabled: bool, checkers: collections.abc.Sequence[suricata_check.checkers.interface.CheckerInterface] | None = None) → suricata_check.utils.checker_typing.OutputReport[source]

Processes a rule file and returns a list of rules and their issues.

Args: rules: A path to a Suricata rules file. evaluate_disabled: A flag indicating whether disabled rules should be evaluated. checkers: The checkers to be used when processing the rule file.

Returns:: A list of rules and their issues.
Raises:: RuntimeError: If no checkers could be automatically discovered.