https://github.com/dgenzer/surify-cli

🧙🏼‍♂️Generate suricata-rules from collection of IOCs (JSON, CSV or flags) based on your suricata template.
https://github.com/dgenzer/surify-cli

generator rules ruleset suricata

Last synced: about 1 month ago
JSON representation

🧙🏼‍♂️Generate suricata-rules from collection of IOCs (JSON, CSV or flags) based on your suricata template.

• Host: GitHub
• URL: https://github.com/dgenzer/surify-cli
• Owner: dgenzer
• License: mit
• Created: 2019-03-19T10:53:04.000Z (over 5 years ago)
• Default Branch: master
• Last Pushed: 2021-08-10T22:38:17.000Z (over 3 years ago)
• Last Synced: 2024-10-20T11:52:20.555Z (about 2 months ago)
• Topics: generator, rules, ruleset, suricata
• Language: JavaScript
• Size: 46.9 KB
• Stars: 3
• Watchers: 1
• Forks: 0
• Open Issues: 2
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

• awesome-suricata - surify-cli - Generate suricata-rules from collection of IOCs (JSON, CSV or flags) based on your suricata template. (Rule/Security Content Management and Handling)

README

        
# surify-cli

Generate suricata-rules from collection of IOCs (JSON, CSV or flags) based on your suricata template.

## Installation

`# npm i -g surify-cli`

## Features

### Inputs

- CSV as input (only with header)

(_you have to manually set the delimiter_)

  - `$ surify c config.json --csv example.csv -d ";" -o suri_csv.rules --sid 1`

- JSON as input

  - `$ surify -c config.json --json example.json -o suri.rules`

- [JSON Lines](http://jsonlines.org/) as input (e.g. from [armbues/ioc-parser](https://github.com/armbues/ioc_parser))

  - `$ surify -c config.json --jsonl example.jsonl -o suri.rules`

- flags as input

  - `$ surify -c config.json --test1 1.2.3.4 --test2 9.9.9.9 --sid 120000 -o log`

### Outputs

- output to stdout 

  - `... -o log`

- output to file

  - `... -o suri.rules`

## Examples

An example `config.json` and some templates `./templates/*` are available. Further examples are available [here](https://github.com/dgenzer/surify-cli/wiki/Examples).

## ToDo

- [ ] Tests

- [x] conditions in **config.json**

  - [ ] Example in wiki

- [ ] **surify.js** as a standalone package

- [ ] autodetect inputtype