search

google / gonids

gonids is a library to parse IDS rules, with a focus primarily on Suricata rule compatibility. There is a discussion forum available that you can join on Google Groups: https://groups.google.com/forum/#!topic/gonids/
Apache License 2.0
180 stars 48 forks source link

Add support for *-event keywords #89

Open duanehoward opened 5 years ago

duanehoward commented 5 years ago

Many examples in OISF ruleset[0] primarily stream-event, app-layer-event, decoder-event etc.) Probably most of these can just be tags? Documentation is rather sparse on some of these.

[0] https://github.com/OISF/suricata/tree/master/rules

danielpoliakov commented 3 years ago

Hi @duanehoward,

I see you decided for *-event keywords as tags. However, current implementation is unable to process the following example taken from https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Protocol_Anomalies_Detection.

s := `alert tcp any any -> any 80 (msg:"SURICATA Port 80 but not HTTP"; flow:to_server; app-layer-protocol:!http; sid:2271002; rev:1;)`

_, err := gonids.ParseRule(s)
if err != nil {
    fmt.Println(err)
}

outputs

no valid value for app-layer-protocol tag

although it is valid value for app-layer-protocol (as seen in Suricata docs).