agentsclimarketplace
Sign in

Writing suricata and snort rules

Skill meltedinhex/analyst-ai-pack/skills/writing-suricata-and-snort-rules

Writes and validates Suricata/Snort IDS rules for network-based malware detection, covering rule anatomy, content/pcre matching, flow and threshold options, and common mistakes that cause false positives or no matches. Activates for requests to write a Suricata rule, create Snort signatures, or build network detection rules from IOCs or C2 patterns.From its SKILL.md

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill writing-suricata-and-snort-rules

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 19 stars19 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.8 KB, 488 tokens by cl100k_base, as published. Nobody here has run it

Writing Suricata and Snort Rules

When to Use

  • You need to author IDS rules to detect C2 traffic, malware downloads, or exploit attempts from observed network indicators.
  • You want to validate rule syntax and avoid the patterns that cause false positives or silent non-matching.

Do not use broad content matches on common substrings that will flood alerts — anchor with flow direction, ports, offsets, and uniqueness. This skill builds and lints rules; deploy them through your IDS change process.

Prerequisites

  • The indicators to detect (URI, host header, TLS SNI/JA3, byte pattern) and a target IDS (Suricata or Snort).

Workflow

Step 1: Draft the rule

Choose action, protocol, addresses/ports, direction, and a unique msg, sid, and rev. Add content/pcre matches anchored with http.uri, tls.sni, flow:established,to_server, and offsets/depths.

Step 2: Lint the rule

python scripts/analyst.py lint rules.rules

Checks for required fields (msg, sid, rev, classtype), balanced quotes/parentheses, non-anchored overly short content, and duplicate SIDs.

Step 3: Tune to reduce noise

Add threshold/detection_filter, flowbits, and specific buffers (http.host, dns.query) to scope matches.

Step 4: Document and stage

Record what each rule detects and stage it for testing against a pcap before production.

Validation

  • Every rule has msg, a unique sid, and a rev.
  • content matches are anchored (buffer/offset/flow) rather than free-floating short strings.
  • Rules parse without unbalanced quotes/parentheses.

Pitfalls

  • Free-floating content:"GET" style matches creating massive false positives.
  • Duplicate or reused SIDs causing rule-load conflicts.
  • Forgetting flow:established and matching on unrelated traffic directions.

References

What ships with it: 3 files

4.3 KB alongside SKILL.md, 1 of them executable

references/

scripts/

Keep looking

Skills are one crate of 326,835. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.