google/gonids
GitHub: google/gonids
gonids 是一个 Go 库，用于解析、生成和优化 Suricata 与 Snort 等引擎的入侵检测系统（IDS）规则。
Stars: 198 | Forks: 50
gonids 是一个用于解析 Snort 和 Suricata 等引擎的 IDS 规则的库。
### 安装说明
```
$ go get github.com/google/gonids
```
### 快速入门
将此导入行添加到您正在处理的文件中：
```
import "github.com/google/gonids"
```
解析规则：
```
rule := `alert tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:"GONIDS TEST hello world"; flow:established,to_server; content:"hello world"; classtype:trojan-activity; sid:1; rev:1;)`
r, err := gonids.ParseRule(rule)
if err != nil {
// Handle parse error
}
// Do something with your rule.
switch r.Action {
case "alert":
// This is an 'alert' rule.
case "drop":
// This is a 'drop' rule.
case "pass":
// This is a 'pass' rule.
default:
// I have no idea what this would be. =)
}
```
创建一条 DNS 规则（使用 dns_query sticky buffer）并将其打印出来：
```
r := gonids.Rule{
Action: "alert",
Protocol: "dns",
Source: Network{
Nets: []string{"any"},
Ports: []string{"any"},
},
Destination: Network{
Nets: []string{"any"},
Ports: []string{"any"},
},
SID: 1234,
Revision: 1,
}
badDomain := "c2.evil.com"
dnsRule.Description = fmt.Sprintf("DNS query for %s", badDomain)
sb, _ := gonids.StickyBuffer("dns_query")
c := &gonids.Content{
DataPosition: sb,
Pattern: []byte(badDomain),
Options: []*gonids.ContentOption{
{"nocase", ""},
},
}
}
fmt.Println(r)
```
为 Suricata 优化 Snort HTTP 规则：
```
rule := `alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"GONIDS TEST hello world"; flow:established,to_server; content:"hello.php"; http_uri; classtype:trojan-activity; sid:1; rev:1;)`
r, err := gonids.ParseRule(rule)
if err != nil {
// Handle parse error
}
r.OptimizeHTTP()
```
### 其他
这不是一款官方的 Google 产品。
标签：EVTX分析, Go语言, Suricata, 入侵检测系统, 安全数据湖, 开源库, 搜索引擎爬虫, 日志审计, 流量安全, 现代安全运营, 程序破解, 规则解析