The suricata-check project - Design Principles

suricata-check is a command line utility to provide feedback on Suricata rules. The tool can detect various issues including those covering syntax validity, interpretability, rule specificity, rule coverage, and efficiency.

This extension is an additional checker for design issues, which can be installed by running the following command:

pip install suricata-check-design-principles

Rules starting with prefix P indicate issues relating to rule design principles posed in the Ruling the Unruly paper. Rules with P-type issues can relate to a specificity and coverage.

Contributing

If you would like to contribute, please check out CONTRIBUTING.md some helpful suggestions and instructions.

License

This project is licensed under the European Union Public Licence (EUPL).