suricata-ipc

一个允许与Suricata共享数据包，并从Eve套接字读取警报的库。读取的警报可以使用智能缓存来确定关于它们的额外元数据。

use suricata_ipc::prelude::*;

#[tokio::main]
async fn main() {
    let rules = Rules::from_path("my.rules").expect("Failed to parse rules");
    let config = Config::default();
    let rules = Rules::from_path(resources.join("test.rules")).expect("Could not parse rules");
    let cache: IntelCache<Rule> = rules.into();
    cache.materialize_rules(config.rule_path.clone()).expect("Failed to materialize rules");

    let mut ids = Ids::new(config).await.expect("Failed to create ids");
    let ids_alerts = ids.take_alerts().expect("No alerts");

    send_packets(&mut ids).await.expect("Failed to send packets");

    let alerts: Result<Vec<_>, Error> = ids_alerts.try_collect().await;
    let alerts: Result<Vec<_>, Error> = alerts.expect("Failed to receive alerts")
        .into_iter().flat_map(|v| v).collect();
    let alerts = alerts.expect("Failed to parse alerts");

    for eve in alerts {
        println!("Eve={:?}", eve);
        if let Some(intel) = cache.observed(eve) {
            if let Observed::Alert { rule, message: _ } = intel {
                println!("Rule={:?}", rule);
            }
        }
    }
}

使用Docker开发

安装lefthook。然后可以运行

lefthook run develop

构建IPC插件

有关说明，请参阅IPC插件README。您需要IPC插件才能使用suricata-ipc。