Skip to content

Commit

Permalink
Added a rule
Browse files Browse the repository at this point in the history
  • Loading branch information
@Koen1999
Koen1999 committed Jan 18, 2025
1 parent 3d8b928 commit 779796d
Showing 1 changed file with 3 additions and 1 deletion.
4 changes: 3 additions & 1 deletion suricata.rules
View file
Original file line number Diff line number Diff line change
@@ -1 +1,3 @@
alert dns any any -> any any (msg:"Request to google.com"; content:"google.com";)
alert dns any any -> any any (msg:"Request to google.com"; content:"google.com";)

Check warning on line 1 in suricata.rules

View workflow job for this annotation

GitHub Actions / Suricata-Check

MsgChecker - S406 

The rule specifies a domain name without escaping the label seperators. Consider escaping the domain names by putting a space before the dot like `foo .bar` to prevent information leaks.

Check notice on line 1 in suricata.rules

View workflow job for this annotation

GitHub Actions / Suricata-Check

BestChecker - C100 

The rule does not use the `target` Suricata meta option. Consider adding the `target` option to specify which IP address is the target of the attack.

Check notice on line 1 in suricata.rules

View workflow job for this annotation

GitHub Actions / Suricata-Check

BestChecker - C101 

The rule does not use set the `created_at` metadata option. Consider adding the `created_at` metadata option to inform users of the recency of this signature.

Check notice on line 1 in suricata.rules

View workflow job for this annotation

GitHub Actions / Suricata-Check

MetadataChecker - S800 

The rule did not specify the `attack_target` metadata option. Consider specifying the `attack_target` metadata option to help analysts interpret alerts raised by this rule.

Check notice on line 1 in suricata.rules

View workflow job for this annotation

GitHub Actions / Suricata-Check

MetadataChecker - S801 

The rule did not specify the `signature_severity` metadata option. Consider specifying the `signature_severity` metadata option to help analysts interpret alerts raised by this rule.

Check notice on line 1 in suricata.rules

View workflow job for this annotation

GitHub Actions / Suricata-Check

MetadataChecker - S802 

The rule did not specify the `performance_impact` metadata option. Consider specifying the `performance_impact` metadata option to help SOCs determine when to enable this rule.

Check notice on line 1 in suricata.rules

View workflow job for this annotation

GitHub Actions / Suricata-Check

MetadataChecker - S803 

The rule did not specify the `deployment` metadata option. Consider specifying the `deployment` metadata option to help SOCs determine when to enable this rule.

Check notice on line 1 in suricata.rules

View workflow job for this annotation

GitHub Actions / Suricata-Check

MsgChecker - S400 

The rule has a non-standard format for the msg field. Consider changing the msg field to `RULESET CATEGORY Description`.

Check notice on line 1 in suricata.rules

View workflow job for this annotation

GitHub Actions / Suricata-Check

OverallChecker - S000 

The rule did not specificy an inbound or outbound direction. Consider constraining the rule to a specific direction such as INBOUND or OUTBOUND traffic.

Check notice on line 1 in suricata.rules

View workflow job for this annotation

GitHub Actions / Suricata-Check

PrincipleChecker - P001 

No Successful Malicious Action, the rule does not distinguish between successful and unsuccessful malicious actions, making it potentially noisy.

Check notice on line 1 in suricata.rules

View workflow job for this annotation

GitHub Actions / Suricata-Check

PrincipleChecker - P002 

No Alert Throttling, the rule does not utilize the threshold limit option` to prevent alert flooding, making it potentially noisy.  Consider setting a threshold limit to prevent alert flooding.  Using track by_both is considered to be safe if unsure which to use.

Check failure on line 1 in suricata.rules

View workflow job for this annotation

GitHub Actions / Suricata-Check

MandatoryChecker - M001 

The rule did not specify a sid, which is a mandatory field.

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"KOEN INFO Outgoing Plaintext HTTP Request"; flow:established,from_client; sid:1; rev:1;)

0 comments on commit 779796d

Please sign in to comment.