nethsec.snort

package documentation
(source)

Module for parsing Snort-like rules.

Parsing is done using regular expressions and the job of this module is to do its best at parsing out fields of interest from the rule rather than perform a sanity check.

The methods that parse multiple rules for a provided input (parse_file, parse_fileobj) return a list of rules instead of dict keyed by ID as its not the job of this module to detect or deal with duplicate signature IDs.

From __init__.py:

Class FlowbitResolver No class docstring; 0/1 instance variable, 0/2 class variable, 1/6 method documented
Class Rule Class representing a rule.
Function add_option Undocumented
Function enable_flowbit_dependencies Helper function to resolve flowbits, wrapping the FlowbitResolver class.
Function find_opt_end Find the end of an option (;) handling escapes.
Function format_sidmsgmap Format a rule as a sid-msg.map entry.
Function format_sidmsgmap_v2 Format a rule as a v2 sid-msg.map entry.
Function parse Parse a single rule for a string buffer.
Function parse_file Parse multiple rules from the provided filename.
Function parse_fileobj Parse multiple rules from a file like object.
Function remove_option Undocumented
Variable actions Undocumented
Variable logger Undocumented
Variable rule_pattern Undocumented
def add_option(rule, name, value, index=None): (source)

Undocumented

def enable_flowbit_dependencies(rulemap): (source)

Helper function to resolve flowbits, wrapping the FlowbitResolver class.

def find_opt_end(options): (source)

Find the end of an option (;) handling escapes.

def format_sidmsgmap(rule): (source)

Format a rule as a sid-msg.map entry.

def format_sidmsgmap_v2(rule): (source)

Format a rule as a v2 sid-msg.map entry.

eg: gid || sid || rev || classification || priority || msg || ref0 || refN

def parse(buf, group=None): (source)

Parse a single rule for a string buffer.

Parameters
bufA string buffer containing a single Snort-like rule
groupUndocumented
Returns
An instance of of .Rule representing the parsed rule
def parse_file(filename, group=None): (source)

Parse multiple rules from the provided filename.

Parameters
filenameName of file to parse rules from
groupUndocumented
Returns
A list of .Rule instances, one for each rule parsed
def parse_fileobj(fileobj, group=None): (source)

Parse multiple rules from a file like object.

Note: At this time rules must exist on one line.

Parameters
fileobjA file like object to parse rules from.
groupUndocumented
Returns
A list of .Rule instances, one for each rule parsed
def remove_option(rule, name): (source)

Undocumented

actions: tuple[str, ...] = (source)

Undocumented

logger = (source)

Undocumented

rule_pattern = (source)

Undocumented