Skip to main content

Format and syntax highlight Suricata rules

Project description


Python package to format and syntax highlight Suricata rules, or: put lipstick on a pig!

With a command-line tool, take terse, stuffy Suricata rules like this:

alert tcp $HOME_NET any -> 6565 (msg:"EmergingThreats:Indicator-2405101"; flow:to_server,established; flags:S; reference:url,; reference:url,; threshold: type limit, track by_src, seconds 360, count 1; classtype:trojan-activity; flowbits:set,ET.Evil; flowbits:set,ET.BotccIP; sid: 533; rev:4991;)

And give them the makeover they deserve

This signature treated herself

alert tcp $HOME_NET any -> 6565 ( \
  msg: "EmergingThreats:Indicator-2405101"; \
  flow: to_server,established; \
  flags: S; \
  reference: url,; \
  reference: url,; \
  threshold: type limit, track by_src, seconds 360, count 1; \
  classtype: trojan-activity; \
  flowbits: set,ET.Evil; \
  flowbits: set,ET.BotccIP; \
  sid: 533; \
  rev: 4991; \

Note: options with line continuations are tested working with Suricata 4.0.4.


pip install suricata-prettifier


Highlight and format right in your console. Wow.

prettify-suricata input.rules

Use it to generate sweet posts for your LiveJournal (Netscape Navigator required to view)

prettify-suricata -f html input.rules input.formatted.html style=vim full=True 

Read from stdin and write to stdou to create your own pipe dream

head -n 50 input.rules | prettify-suricata -f html - - style=vim full=True | tee input.formatted.html

Project details

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Files for suricata-prettifier, version 0.0.2
Filename, size File type Python version Upload date Hashes
Filename, size suricata-prettifier-0.0.2.tar.gz (4.5 kB) File type Source Python version None Upload date Hashes View

Supported by

Pingdom Pingdom Monitoring Google Google Object Storage and Download Analytics Sentry Sentry Error logging AWS AWS Cloud computing DataDog DataDog Monitoring Fastly Fastly CDN DigiCert DigiCert EV certificate StatusPage StatusPage Status page