Suricata rule parser
Project description
Pure python parser for Snort/Suricata rules.
Install
Requires Python >= 3.6.
pip install suricataparser
Usage
>>> from suricataparser import parse_rule, parse_file
Parse rules file:
>>> rules = parse_file("suricata.rules")
Parse raw rule:
>>> rule = parse_rule('alert tcp any any -> any any (sid:1; gid:1;)') >>> print(rule) alert tcp any any -> any any (msg:"Msg"; sid:1; gid:1;)
View rule properties:
>>> rule.sid 1 >>> rule.action alert >>> rule.header tcp any any -> any any >>> rule.msg '"Msg"'
Turn on/off rule:
>>> rule.enabled True >>> rule.enabled = False >>> print(rule) # alert tcp any any -> any any (msg:"Msg"; sid:1; gid:1;)
Modify options:
>>> rule.add_option("http_uri") >>> rule.add_option("key", "value") >>> print(rule) alert tcp any any -> any any (msg: "Msg"; sid: 1; gid: 1; http_uri; key: value;) >>> rule.pop_option("key") >>> print(rule) alert tcp any any -> any any (msg: "Msg"; sid: 1; gid: 1; http_uri;)
Project details
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
suricataparser-0.0.5.tar.gz
(7.6 kB
view hashes)
Built Distribution
Close
Hashes for suricataparser-0.0.5-py3-none-any.whl
Algorithm | Hash digest | |
---|---|---|
SHA256 | f45a3a99acc87fbd4596df251a5d0ce1b5b993a7fe5d8cca428a4674cdbfa5b7 |
|
MD5 | 5159207dde78e4c81a3fe68b055acf01 |
|
BLAKE2b-256 | 5e758668fccbcdd49e1788e42f4649dfb2562ce7e77db4ecf613667cc8b66c36 |