Suricata rule parser
Project description
Pure python parser for Snort/Suricata rules.
Install
Requires Python >= 3.6.
pip install suricataparser
Usage
>>> from suricataparser import parse_rule, parse_file
Parse rules file:
>>> rules = parse_file("suricata.rules")
Parse raw rule:
>>> rule = parse_rule('alert tcp any any -> any any (sid:1; gid:1;)') >>> print(rule) alert tcp any any -> any any (msg:"Msg"; sid:1; gid:1;)
View rule properties:
>>> rule.sid 1 >>> rule.action alert >>> rule.header tcp any any -> any any >>> rule.msg '"Msg"'
Turn on/off rule:
>>> rule.enabled True >>> rule.enabled = False >>> print(rule) # alert tcp any any -> any any (msg:"Msg"; sid:1; gid:1;)
Modify options:
>>> rule.add_option("http_uri") >>> rule.add_option("key", "value") >>> print(rule) alert tcp any any -> any any (msg: "Msg"; sid: 1; gid: 1; http_uri; key: value;) >>> rule.pop_option("key") >>> print(rule) alert tcp any any -> any any (msg: "Msg"; sid: 1; gid: 1; http_uri;)
Project details
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
suricataparser-0.0.4.tar.gz
(7.6 kB
view hashes)
Built Distribution
Close
Hashes for suricataparser-0.0.4-py3-none-any.whl
Algorithm | Hash digest | |
---|---|---|
SHA256 | 6bc27de15a829686601f5aadce179e76456d060e66749855bb93d3cb51c3e52e |
|
MD5 | 791ca1968032418bfeddff1274054b4a |
|
BLAKE2b-256 | d0ca3603efef847f13a2f70beb003a88b61f43e53eb262a150c7a4a2827d1b22 |