Skip to main content
Join the official 2019 Python Developers SurveyStart the survey!

Parse Suricata rules

Project description

parsuricata

Parse Suricata rules

Installation

pip install parsuricata

Usage

from parsuricata import parse_rules

source = '''
  alert http $HOME_NET any -> !$HOME_NET any (msg: "hi mum!"; content: "heymum"; http_uri; sid: 1;)
'''

rules = parse_rules(source)
print(rules)
#
# alert http $HOME_NET any -> !$HOME_NET any ( \
#   msg: hi mum!; \
#   content: heymum; \
#   http_uri; \
#   sid: 1; \
# )

rule = rules[0]

print(rule.action)
# alert

print(rule.protocol)
# http

print(rule.src)
# $HOME_NET

print(rule.src_port)
# any

print(rule.direction)
# ->

print(rule.dst)
# !$HOME_NET

print(rule.dst_port)
# any

for option in rule.options:
    print(f'{option.keyword} = {option.settings}')
#
# msg = hi mum!
# content = heymum
# http_uri = None
# sid = 1

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Files for parsuricata, version 0.1.1
Filename, size File type Python version Upload date Hashes
Filename, size parsuricata-0.1.1-py3-none-any.whl (4.3 kB) File type Wheel Python version py3 Upload date Hashes View hashes
Filename, size parsuricata-0.1.1.tar.gz (3.8 kB) File type Source Python version None Upload date Hashes View hashes

Supported by

Elastic Elastic Search Pingdom Pingdom Monitoring Google Google BigQuery Sentry Sentry Error logging AWS AWS Cloud computing DataDog DataDog Monitoring Fastly Fastly CDN SignalFx SignalFx Supporter DigiCert DigiCert EV certificate StatusPage StatusPage Status page