suricata_check.utils.rule

Module replacing idstools.rule and providing limited but similar functionality.

This module is inspired by and mostly uses the same interface Python idstools package. (https://github.com/jasonish/py-idstools)

Exceptions

ParsingError

Raised when a rule cannot be parsed by suricata-check.

Classes

Rule	Class representing a rule.
RuleOption	Class representing a rule option.

Functions

parse(→ Optional[Rule])

Parse a rule stringand return a wrapped Rule instance.

Module Contents

exception suricata_check.utils.rule.ParsingError(message: str)

Bases: RuntimeError

Raised when a rule cannot be parsed by suricata-check.

Most likely, such a rule is also an invalid Suricata rule.

Initializes the ParsingError with the raw rule as message.

class suricata_check.utils.rule.Rule(*args: tuple, **kwargs: dict)

Class representing a rule.

Private Init function.

Use suricata_check.utils.rule.parse() instead to create Rule instances.

__hash__() → int

Returns a unique hash that can be used as a fingerprint for the rule.

__str__() → str

Returns the raw rule as a string.

add_flowbits_option(value: str) → None

Adds a flowbits option in the rule’s flowbits list.

add_metadata_option(value: str) → None

Adds metadata options in the rule’s metadata list.

add_metadata_options(values: collections.abc.Sequence[str]) → None

Adds metadata options in the rule’s metadata list.

add_option(name: str, value: str | None) → None

Adds an option in the rule’s options list.

add_reference_option(value: str) → None

Adds a reference option in the rule’s references list.

action: str

dest_addr: str

dest_port: str

direction: str

enabled: bool

flowbits: tuple[str, Ellipsis] = ()

header: str

metadata: tuple[str, Ellipsis] = ()

options: tuple[RuleOption, Ellipsis] = ()

proto: str

raw: str

references: tuple[str, Ellipsis] = ()

source_addr: str

source_port: str

class suricata_check.utils.rule.RuleOption

Class representing a rule option.

__hash__() → int

Returns a unique hash that can be used as a fingerprint for the rule option.

name: str

value: str | None = None

suricata_check.utils.rule.parse(buffer: str) → Rule | None

Parse a rule stringand return a wrapped Rule instance.

Returns None when the text could not be parsed as a rule.

Parameters:

buffer – A string containing a single Suricata-like rule

Returns:

An instance of of Rule representing the parsed rule