{"id":13530315,"url":"https://github.com/google/gonids","last_synced_at":"2025-04-01T18:31:32.088Z","repository":{"id":41403784,"uuid":"74061816","full_name":"google/gonids","owner":"google","description":"gonids is a library to parse IDS rules, with a focus primarily on Suricata rule compatibility. There is a discussion forum available that you can join on Google Groups: https://groups.google.com/forum/#!topic/gonids/","archived":false,"fork":false,"pushed_at":"2022-12-14T05:13:15.000Z","size":401,"stargazers_count":183,"open_issues_count":9,"forks_count":50,"subscribers_count":11,"default_branch":"master","last_synced_at":"2025-03-22T00:41:50.726Z","etag":null,"topics":["ids","network","network-security","parse","security-tools","suricata"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/google.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2016-11-17T19:50:26.000Z","updated_at":"2025-02-05T22:52:23.000Z","dependencies_parsed_at":"2023-01-28T17:01:25.098Z","dependency_job_id":null,"html_url":"https://github.com/google/gonids","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/google%2Fgonids","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/google%2Fgonids/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/google%2Fgonids/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/google%2Fgonids/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/google","download_url":"https://codeload.github.com/google/gonids/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246691570,"owners_count":20818533,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ids","network","network-security","parse","security-tools","suricata"],"created_at":"2024-08-01T07:00:47.866Z","updated_at":"2025-04-01T18:31:31.779Z","avatar_url":"https://github.com/google.png","language":"Go","funding_links":[],"categories":["Programming Libraries and Toolkits"],"sub_categories":[],"readme":"gonids is a library to parse IDS rules for engines like Snort and Suricata.\n\n### Installation\n```\n$ go get github.com/google/gonids\n```\n\n### Quick Start\nAdd this import line to the file you're working in:\n```\nimport \"github.com/google/gonids\"\n```\n\nTo parse a rule:\n```\nrule := `alert tcp $HOME_NET any -\u003e $EXTERNAL_NET 80 (msg:\"GONIDS TEST hello world\"; flow:established,to_server; content:\"hello world\"; classtype:trojan-activity; sid:1; rev:1;)`\nr, err := gonids.ParseRule(rule)\nif err != nil {\n  // Handle parse error\n}\n// Do something with your rule.\nswitch r.Action {\ncase \"alert\":\n  // This is an 'alert' rule.\ncase \"drop\":\n  // This is a 'drop' rule.\ncase \"pass\":\n  // This is a 'pass' rule.\ndefault:\n  // I have no idea what this would be. =)\n}\n```\n\nTo create a rule a DNS rule (using dns_query sticky buffer) and print it:\n```\nr := gonids.Rule{\n\tAction:   \"alert\",\n\tProtocol: \"dns\",\n\tSource: Network{\n\t\tNets:  []string{\"any\"},\n\t\tPorts: []string{\"any\"},\n\t},\n\tDestination: Network{\n\t\tNets:  []string{\"any\"},\n\t\tPorts: []string{\"any\"},\n\t},\n\tSID:         1234,\n\tRevision:    1,\n}\n\nbadDomain := \"c2.evil.com\"\ndnsRule.Description = fmt.Sprintf(\"DNS query for %s\", badDomain)\n\nsb, _ := gonids.StickyBuffer(\"dns_query\")\nc := \u0026gonids.Content{\n\t\t\tDataPosition: sb,\n\t\t\tPattern:      []byte(badDomain),\n\t\t\tOptions: []*gonids.ContentOption{\n\t\t\t\t{\"nocase\", \"\"},\n\t\t\t},\n\t\t}\n}\n\nfmt.Println(r)\n```\n\nTo optimize a Snort HTTP rule for Suricata:\n```\nrule := `alert tcp $HOME_NET any -\u003e $EXTERNAL_NET $HTTP_PORTS (msg:\"GONIDS TEST hello world\"; flow:established,to_server; content:\"hello.php\"; http_uri; classtype:trojan-activity; sid:1; rev:1;)`\nr, err := gonids.ParseRule(rule)\nif err != nil {\n  // Handle parse error\n}\nr.OptimizeHTTP()\n```\n\n### Miscellaneous\nThis is not an official Google product.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgoogle%2Fgonids","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgoogle%2Fgonids","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgoogle%2Fgonids/lists"}