Rule Parsing

The idstools rule parsing can parse individual rule strings as well as multiple rules from a file or file like objects.

The Rule Object

The parsing functions will return one, or a list of Rule objects that present the rule as a dictionary.

class idstools.rule.Rule(enabled=None, action=None, group=None)[source]

Class representing a rule.

The Rule class is a class that also acts like a dictionary.

Dictionary fields:

  • group: The group the rule belongs to, typically the filename.
  • enabled: True if rule is enabled (uncommented), False is disabled (commented)
  • action: The action of the rule (alert, pass, etc) as a string
  • proto: The protocol string of the rule.
  • source_addr: The source address string of the rule.
  • source_port: The source ports string of the rule.
  • direction: The direction string of the rule.
  • dest_addr: The destination address string of the rule.
  • dest_port: The destination ports string of the rule.
  • gid: The gid of the rule as an integer
  • sid: The sid of the rule as an integer
  • rev: The revision of the rule as an integer
  • msg: The rule message as a string
  • flowbits: List of flowbit options in the rule
  • metadata: Metadata values as a list
  • references: References as a list
  • classtype: The classification type
  • priority: The rule priority, 0 if not provided
  • raw: The raw rule as read from the file or buffer
Parameters:
  • enabled – Optional parameter to set the enabled state of the rule
  • action – Optional parameter to set the action of the rule
  • group – Optional parameter to set the group (filename) of the rule

Note

Parsed rules are primarily read only, with the exception of toggling the enabled state of the rule, modification is not really supported.

Parsing

rule.parse(group=None)

Parse a single rule for a string buffer.

Parameters:buf – A string buffer containing a single Snort-like rule
Returns:An instance of of Rule representing the parsed rule
rule.parse_fileobj(group=None)

Parse multiple rules from a file like object.

Note: At this time rules must exist on one line.

Parameters:fileobj – A file like object to parse rules from.
Returns:A list of Rule instances, one for each rule parsed
rule.parse_file(group=None)

Parse multiple rules from the provided filename.

Parameters:filename – Name of file to parse rules from
Returns:A list of Rule instances, one for each rule parsed

Printing

The string representation of the object will print the full rule respecting the enabled option of the rule.

For example:

>>> idstools.rule.parse('alert ip any any -> any any (msg:"TEST MESSAGE"; content:"uid=0|28|root|29|"; classtype:bad-unknown; sid:10000000; rev:1;)')
>>> rule = idstools.rule.parse('alert ip any any -> any any (msg:"TEST MESSAGE"; content:"uid=0|28|root|29|"; classtype:bad-unknown; sid:10000000; rev:1;)')
>>> print(rule)
alert ip any any -> any any (msg:"TEST MESSAGE"; content:"uid=0|28|root|29|"; classtype:bad-unknown; sid:10000000; rev:1;)
>>> rule["enabled"] = False
>>> print(rule)
# alert ip any any -> any any (msg:"TEST MESSAGE"; content:"uid=0|28|root|29|"; classtype:bad-unknown; sid:10000000; rev:1;)

A brief description of the rule can be printed with idstools.rule.Rule.brief() or a string representing the rule ID can be printed with idstools.rule.Rule.idstr().

Flowbit Resolution

The idstools.rule.FlowbitResolver is able to resolve the flowbits for a set of rules presented as a dictionary.