Repository navigation
Conversation
Validate the syntax of detection rules through the public Rulezet API (/api/rule/public/validate) and return the result as a rule-validation MISP object referencing the validated attribute or object (validates). Supported inputs: yara, sigma, snort, zeek, bro and kusto-query attributes, and the rule objects exported by Rulezet (yara, sigma, suricata, zeek, nse, nse-script, nova-rule, wazuh-rule, kunai-rule, owasp-crs-rule, splunk-rule, elastic-detection-rule, kql-analytics-rule, atr, plum, sagan, rulezet-metadata).
Member
|
Thank you! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
New expansion/hover module,
rulezet_validator, that checks the syntax of detection rules with the public Rulezet API (POST /api/rule/public/validate). Rulezet runs the same syntax check it uses when a rule is created, but only as a dry run: nothing is stored on the Rulezet side.Instead of returning plain text like the existing
*_syntax_validatormodules, it returns arule-validationMISP object. MISP UIs and tools can then display and use the result in a structured way.Supported inputs
yaraattribute /yaraobjectsigmaattribute /sigmaobjectsnortattribute /suricataobjectzeek,broattributes /zeekobjectkusto-queryattribute /kql-analytics-ruleobjectnse,nse-scriptobjectsnova-ruleobjectwazuh-ruleobjectkunai-ruleobjectowasp-crs-ruleobjectsplunk-ruleobjectelastic-detection-ruleobjectatr,plum,saganobjectsrulezet-metadataobject (format read from itsformatfield)The object mapping follows the objects Rulezet itself exports to MISP, so rules imported from Rulezet can be validated directly.
Output
A
rule-validationobject with:format: the Rulezet format usedvalid: booleanerror/warning: one attribute per message returned by the validatorvalidator,validator-url,validation-dateThe object references the validated attribute or object with a
validatesrelationship.Need : MISP/misp-objects#535 too