pevma / rule2alert Goto Github PK
View Code? Open in Web Editor NEWImprovements of/over the original rule2alert
Home Page: http://code.google.com/p/rule2alert/
Improvements of/over the original rule2alert
Home Page: http://code.google.com/p/rule2alert/
python r2a.py -C /etc/suricata/suricata-debian.yaml -f rules/emerging-all.rules -e 1.2.3.4 -m 10.0.0.123 -w test.pcap -v
using Linux Mint
python-yaml, python-scapy are installed. Python 2.7.6 is installed.
Output errors from the above command can be found here: http://justpaste.it/obsk
This project should be rewritten in Python3 to be still valid nowadays...
Thanks!
I cat'd a bunch of rules into one file, and when r2a got to the flowbit's it error'd out.
Here is the last few lines:
Loaded 11277 rules succesfully!
Loading flowbits rules...
found only SET in flowbit name ET.HTTP.at.SSL 2013933,set,2013931,set,2013927,set,2013929,set,2013926,set,2013928,set,2013930,set,2013932,set
found only SET in flowbit name ms.rdp.established 2014386,set
found only SET in flowbit name ET.ass.request 2010757,set
found only SET in flowbit name ET.BotccIP 2404101,set,2404103,set,2404105,set,2404107,set,2404109,set,2404111,set,2404113,set,2404115,set,2404117,set,2404119,set,2404121,set,2404123,set,2404125,set,2404127,set,2404129,set,2404131,set,2404133,set,2404135,set,2404137,set,2404139,set,2404141,set,2404143,set,2404145,set,2404147,set
found only SET in flowbit name ET.zbot.ua.2106509 2016509,set
found only SET in flowbit name ET.bd1 2009240,set
I cloned the git and started the r2a out of the box, but it gave me the error of constructor returning value on following command.
sudo python r2a.py -m "192.168.1.170" -e "192.168.120.240" -f ~/rule2alert/rules/blacklist.rules -w blacklist.pcap
`Traceback (most recent call last):
File "r2a.py", line 96, in main
r = Rule(snort_rule)
TypeError: init() should return None
Parser failed - skipping rule
Loaded 0 rules succesfully!`
I tried to fix the code but to no avail. It build rules now but produces malformed packets. Could you please fix the issue.
Best regards
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.