With #Suricata Language Server 1.2.0 it will be possible to check the signatures in the file against a PCAP file. You will instantly know if the signature match and what is its CPU cost. Check the video for a demo of the feature.
Remote
Éric Leblond
@Regit@infosec.exchange
mastodon 4.8.0-alpha.3+glitchCo-founder and CTO at Stamus Networks. All things Suricata and Netfilter.
298 Followers
84 Following
15 Posts
Joined November 10, 2022
Great talk about PostgreSQL community by @clairegiordano@hachyderm.io . Loved the point "ability to work (and fail) in public" in the arsenal you need to have to become an open Source developer.
Stamus Networks has released Clear NDR Community 1.1.0. Our Open Source #Suricata based #NDR has an exciting new UI available in preview. This new code base introduces some great new views and data analysis methods. Feedback welcome!
See https://docs.clearndr.io/ for installation or upgrade.
Massive contribution to @suricata@infosec.exchange by
Todd Mortimer from the Canadian Centre for Cyber Security (https://www.cyber.gc.ca/en). The HTTP support is now handled by a Rust crate: https://github.com/OISF/suricata/commit/9c324b796e6b4b8ec222dd1ce8649a9d616f3581
This is so good to see contributions from governmental organization to common good.
Replying to @Regit@infosec.exchange
Rules profiling in #Suricata Language Server is now pushed to main branch. Current default Suricata image from @ish@infosec.exchange should have rules profiling when https://github.com/jasonish/docker-suricata/pull/53 get merged. For now, only local Suricata with correct build will provide profiling.
We need an island command to sandbox a build and install (cc @l0kod@mastodon.social) ;)
Replying to @paul@notnull.space
@paul@notnull.space oh, big thanks! I was so frustrated not to get a correct link to the speaker!
Suricata Language Server 1.3.0 is now available and it surfs on the concept of magic comment introduced in version 1.0.0 to add some game-changing features for the Suricata signature writer. Main features are the capability to test the signatures in a file against a pcap when writing the file and the support of Suricata version selection.
In this release, we also introduce LSP-based syntax highlighting, so no external modules are necessary to get colors when writing signatures.
More information on Stamus Networks’ blog: https://www.stamus-networks.com/blog/suricata-language-server-1.3-automated-pcap-testing-and-multi-version-support
Replying to @Regit@infosec.exchange
As discussed during #Suricon2025 I've also added the profiling of the signatures if a pcap file if specified in comment.
@catenacyber@bird.makeup showing improvements on readability of bit mask operation on integer match in Suricata. #SuriCon25
Replying to @Regit@infosec.exchange
Suricata Language Server 2.0 is available with a lot of improvements and new capabilities. On top of providing syntax checking, performance analysis and highlighting in your preferred IDE when writing Suricata signatures, this LSP server is now coming with really efficient AI skills to write and explain signatures and a Github action to validate signature files before pushing to production.
More info:
https://www.stamus-networks.com/blog/suricata-language-server-2.0