parsuricata
Parse Suricata rules
Installation
pip install parsuricata
Usage
from parsuricata import parse_rules
source = '''
alert http $HOME_NET any -> !$HOME_NET any (msg: "hi mum!"; content: "heymum"; http_uri; sid: 1;)
'''
rules = parse_rules(source)
print(rules)
#
# alert http $HOME_NET any -> !$HOME_NET any ( \
# msg: hi mum!; \
# content: heymum; \
# http_uri; \
# sid: 1; \
# )
rule = rules[0]
print(rule.action)
# alert
print(rule.protocol)
# http
print(rule.src)
# $HOME_NET
print(rule.src_port)
# any
print(rule.direction)
# ->
print(rule.dst)
# !$HOME_NET
print(rule.dst_port)
# any
for option in rule.options:
print(f'{option.keyword} = {option.settings}')
#
# msg = hi mum!
# content = heymum
# http_uri = None
# sid = 1
1 maintainer
Metadata
1 maintainer
Release files for parsuricata 0.4.1
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| parsuricata-0.4.1.tar.gz | 8.2 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| parsuricata-0.4.1-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 13.9 kB
Release files / parsuricata-0.4.1.tar.gz
| Download URL | parsuricata-0.4.1.tar.gz |
|---|---|
| Size | 8.2 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
3757f4dac68625642e9a053f3fa8fe008b1f79406a3763c51efd16fa60db09ca
|
|
BLAKE2b-256 checksum How to use checksums |
299e7e79812e15b634698b527e6b6c88f9ea79dca856588e1ebfbf9568d9e3f6
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
poetry/1.5.1 CPython/3.10.12 Linux/5.13.0-52-generic
|
Release files / parsuricata-0.4.1-py3-none-any.whl
| Download URL | parsuricata-0.4.1-py3-none-any.whl |
|---|---|
| Size | 5.7 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
e6c4c46e2447d7067e67e170823a9a6fc7ae1faa8405333c9fb9c965dc481134
|
|
BLAKE2b-256 checksum How to use checksums |
96fcdfe0d0458c7c2843ffd1be5da1b4a6b2f790dd5c4a74a97a4a5b73597d02
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
poetry/1.5.1 CPython/3.10.12 Linux/5.13.0-52-generic
|
