1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
| PS C:\Users\koent> suricata-check -r .\ruling-the-unruly\original.rules --log-level=INFO
suricata-check 7.0.0b0.post3+git.c81c1c93.dirty
2025-11-10 12:00:57,470 - suricata_check.suricata_check - INFO - Running suricata-check with the following arguments:
2025-11-10 12:00:57,478 - suricata_check.suricata_check - INFO - rules: .\ruling-the-unruly\original.rules
2025-11-10 12:00:57,479 - suricata_check.suricata_check - INFO - single_rule: None
2025-11-10 12:00:57,480 - suricata_check.suricata_check - INFO - out: .
2025-11-10 12:00:57,481 - suricata_check.suricata_check - INFO - log_level: INFO
2025-11-10 12:00:57,482 - suricata_check.suricata_check - INFO - gitlab: False
2025-11-10 12:00:57,482 - suricata_check.suricata_check - INFO - github: False
2025-11-10 12:00:57,483 - suricata_check.suricata_check - INFO - evaluate_disabled: False
2025-11-10 12:00:57,483 - suricata_check.suricata_check - INFO - issue_severity: INFO
2025-11-10 12:00:57,484 - suricata_check.suricata_check - INFO - include_all: False
2025-11-10 12:00:57,484 - suricata_check.suricata_check - INFO - include: ()
2025-11-10 12:00:57,484 - suricata_check.suricata_check - INFO - exclude: ()
2025-11-10 12:00:57,576 - suricata_check._checkers - INFO - Discovered and enabled checkers: [BestChecker, UnexpectedChecker, MandatoryChecker, MetadataChecker, MsgChecker, OrderChecker, OverallChecker, PcreChecker, PerformanceChecker, ReferenceChecker, SidChecker, StateChecker, WhitespaceChecker]
2025-11-10 12:00:57,577 - suricata_check.utils._path - INFO - Found Suricata rules file: .\ruling-the-unruly\original.rules
2025-11-10 12:00:57,594 - suricata_check.suricata_check - INFO - Processing rule file: .\ruling-the-unruly\original.rules
2025-11-10 12:00:57,676 - suricata_check.suricata_check - INFO - Completed processing rule file: .\ruling-the-unruly\original.rules
2025-11-10 12:00:57,677 - suricata_check._output - INFO - Writing output to suricata-check.jsonl and suricata-check-fast.log in C:\Users\koent
[C100] (INFO) Lines 1-1, sid 2012726: The rule does not use the `target` Suricata meta option. Consider adding the `target` option to specify which IP address is the target of the attack.
[S800] (INFO) Lines 1-1, sid 2012726: The rule did not specify the `attack_target` metadata option. Consider specifying the `attack_target` metadata option to help analysts interpret alerts raised by this rule.
[S801] (INFO) Lines 1-1, sid 2012726: The rule did not specify the `signature_severity` metadata option. Consider specifying the `signature_severity` metadata option to help analysts interpret alerts raised by this rule.
[S802] (INFO) Lines 1-1, sid 2012726: The rule did not specify the `performance_impact` metadata option. Consider specifying the `performance_impact` metadata option to help SOCs determine when to enable this rule.
[S803] (INFO) Lines 1-1, sid 2012726: The rule did not specify the `deployment` metadata option. Consider specifying the `deployment` metadata option to help SOCs determine when to enable this rule.
[C100] (INFO) Lines 3-3, sid 2016184: The rule does not use the `target` Suricata meta option. Consider adding the `target` option to specify which IP address is the target of the attack.
[S800] (INFO) Lines 3-3, sid 2016184: The rule did not specify the `attack_target` metadata option. Consider specifying the `attack_target` metadata option to help analysts interpret alerts raised by this rule.
[S801] (INFO) Lines 3-3, sid 2016184: The rule did not specify the `signature_severity` metadata option. Consider specifying the `signature_severity` metadata option to help analysts interpret alerts raised by this rule.
[S802] (INFO) Lines 3-3, sid 2016184: The rule did not specify the `performance_impact` metadata option. Consider specifying the `performance_impact` metadata option to help SOCs determine when to enable this rule.
[S803] (INFO) Lines 3-3, sid 2016184: The rule did not specify the `deployment` metadata option. Consider specifying the `deployment` metadata option to help SOCs determine when to enable this rule.
[S021] (INFO) Lines 3-3, sid 2016184: The rule has multiple content matches but does not use fast_pattern. Consider assigning fast_pattern to the most unique content match.
[S120] (INFO) Lines 3-3, sid 2016184: The rule did not escape (\x3a\x3b\x20\x22\x27\x7b\x7c\x5c\x2f\x60\x24\x28\x29) in a content field. Consider using hex encoding instead.
[C100] (INFO) Lines 5-5, sid 2024897: The rule does not use the `target` Suricata meta option. Consider adding the `target` option to specify which IP address is the target of the attack.
[S802] (INFO) Lines 5-5, sid 2024897: The rule did not specify the `performance_impact` metadata option. Consider specifying the `performance_impact` metadata option to help SOCs determine when to enable this rule.
[S232] (INFO) Lines 5-5, sid 2024897: The rule contains the nocase option before size options, transformation options, the content option, pointer movement options, or fast_pattern option in sequence ('http.user_agent', 'content', 'nocase', 'fast_pattern'). Consider moving the nocase option to after size options, transformation options, the content option, pointer movement options, or fast_pattern option.
[C100] (INFO) Lines 7-7, sid 2025756: The rule does not use the `target` Suricata meta option. Consider adding the `target` option to specify which IP address is the target of the attack.
[S002] (INFO) Lines 7-7, sid 2025756: The rule detects exploitation attempts in a constrained direction without specifying the direction in the rule msg. Consider setting `src_addr` and `dest_addr` to any to also account for lateral movement scenarios. Alternatively, you can specify the direction (i.e., `Internal` or `Inbound`) in the rule `msg`.
[S120] (INFO) Lines 7-7, sid 2025756: The rule did not escape (\x3a\x3b\x20\x22\x27\x7b\x7c\x5c\x2f\x60\x24\x28\x29) in a content field. Consider using hex encoding instead.
[C100] (INFO) Lines 9-9, sid 92009358: The rule does not use the `target` Suricata meta option. Consider adding the `target` option to specify which IP address is the target of the attack.
[S800] (INFO) Lines 9-9, sid 92009358: The rule did not specify the `attack_target` metadata option. Consider specifying the `attack_target` metadata option to help analysts interpret alerts raised by this rule.
[S801] (INFO) Lines 9-9, sid 92009358: The rule did not specify the `signature_severity` metadata option. Consider specifying the `signature_severity` metadata option to help analysts interpret alerts raised by this rule.
[S802] (INFO) Lines 9-9, sid 92009358: The rule did not specify the `performance_impact` metadata option. Consider specifying the `performance_impact` metadata option to help SOCs determine when to enable this rule.
[S803] (INFO) Lines 9-9, sid 92009358: The rule did not specify the `deployment` metadata option. Consider specifying the `deployment` metadata option to help SOCs determine when to enable this rule.
[S232] (INFO) Lines 9-9, sid 92009358: The rule contains the nocase option before size options, transformation options, the content option, pointer movement options, or fast_pattern option in sequence ('http.user_agent', 'content', 'nocase', 'depth'). Consider moving the nocase option to after size options, transformation options, the content option, pointer movement options, or fast_pattern option.
[S303] (INFO) Lines 9-9, sid 92009358: Allocation to unallocated SID range, whereas a reserved range should be used. Consider using an sid in one of the following ranges: [(2700000, 2799999)].
[S500] (INFO) Lines 9-9, sid 92009358: The rule specifies the connection state after the connection direction in the `flow` option. Consider specifying the connection state first like `established,to_server`.
[S120] (INFO) Lines 9-9, sid 92009358: The rule did not escape (\x3a\x3b\x20\x22\x27\x7b\x7c\x5c\x2f\x60\x24\x28\x29) in a content field. Consider using hex encoding instead.
[C100] (INFO) Lines 11-11, sid 92017808: The rule does not use the `target` Suricata meta option. Consider adding the `target` option to specify which IP address is the target of the attack.
[S800] (INFO) Lines 11-11, sid 92017808: The rule did not specify the `attack_target` metadata option. Consider specifying the `attack_target` metadata option to help analysts interpret alerts raised by this rule.
[S801] (INFO) Lines 11-11, sid 92017808: The rule did not specify the `signature_severity` metadata option. Consider specifying the `signature_severity` metadata option to help analysts interpret alerts raised by this rule.
[S802] (INFO) Lines 11-11, sid 92017808: The rule did not specify the `performance_impact` metadata option. Consider specifying the `performance_impact` metadata option to help SOCs determine when to enable this rule.
[S803] (INFO) Lines 11-11, sid 92017808: The rule did not specify the `deployment` metadata option. Consider specifying the `deployment` metadata option to help SOCs determine when to enable this rule.
[S402] (INFO) Lines 11-11, sid 92017808: The rule uses vague keywords such as possible or unknown in the msg field. Consider rephrasing to provide a more clear message for interpreting generated alerts.
[S303] (INFO) Lines 11-11, sid 92017808: Allocation to unallocated SID range, whereas a reserved range should be used. Consider using an sid in one of the following ranges: [(2700000, 2799999)].
[S500] (INFO) Lines 11-11, sid 92017808: The rule specifies the connection state after the connection direction in the `flow` option. Consider specifying the connection state first like `established,to_server`.
[C100] (INFO) Lines 13-13, sid 92024364: The rule does not use the `target` Suricata meta option. Consider adding the `target` option to specify which IP address is the target of the attack.
[S402] (INFO) Lines 13-13, sid 92024364: The rule uses vague keywords such as possible or unknown in the msg field. Consider rephrasing to provide a more clear message for interpreting generated alerts.
[S303] (INFO) Lines 13-13, sid 92024364: Allocation to unallocated SID range, whereas a reserved range should be used. Consider using an sid in one of the following ranges: [(2700000, 2799999)].
[S500] (INFO) Lines 13-13, sid 92024364: The rule specifies the connection state after the connection direction in the `flow` option. Consider specifying the connection state first like `established,to_server`.
[C100] (INFO) Lines 15-15, sid 92006445: The rule does not use the `target` Suricata meta option. Consider adding the `target` option to specify which IP address is the target of the attack.
[S802] (INFO) Lines 15-15, sid 92006445: The rule did not specify the `performance_impact` metadata option. Consider specifying the `performance_impact` metadata option to help SOCs determine when to enable this rule.
[S402] (INFO) Lines 15-15, sid 92006445: The rule uses vague keywords such as possible or unknown in the msg field. Consider rephrasing to provide a more clear message for interpreting generated alerts.
[S232] (INFO) Lines 15-15, sid 92006445: The rule contains the nocase option before size options, transformation options, the content option, pointer movement options, or fast_pattern option in sequence ('content', 'nocase', 'distance'). Consider moving the nocase option to after size options, transformation options, the content option, pointer movement options, or fast_pattern option.
[S021] (INFO) Lines 15-15, sid 92006445: The rule has multiple content matches but does not use fast_pattern. Consider assigning fast_pattern to the most unique content match.
[S303] (INFO) Lines 15-15, sid 92006445: Allocation to unallocated SID range, whereas a reserved range should be used. Consider using an sid in one of the following ranges: [(2700000, 2799999)].
[C100] (INFO) Lines 17-17, sid 92006446: The rule does not use the `target` Suricata meta option. Consider adding the `target` option to specify which IP address is the target of the attack.
[S802] (INFO) Lines 17-17, sid 92006446: The rule did not specify the `performance_impact` metadata option. Consider specifying the `performance_impact` metadata option to help SOCs determine when to enable this rule.
[S402] (INFO) Lines 17-17, sid 92006446: The rule uses vague keywords such as possible or unknown in the msg field. Consider rephrasing to provide a more clear message for interpreting generated alerts.
[S232] (INFO) Lines 17-17, sid 92006446: The rule contains the nocase option before size options, transformation options, the content option, pointer movement options, or fast_pattern option in sequence ('content', 'nocase', 'distance'). Consider moving the nocase option to after size options, transformation options, the content option, pointer movement options, or fast_pattern option.
[S021] (INFO) Lines 17-17, sid 92006446: The rule has multiple content matches but does not use fast_pattern. Consider assigning fast_pattern to the most unique content match.
[S303] (INFO) Lines 17-17, sid 92006446: Allocation to unallocated SID range, whereas a reserved range should be used. Consider using an sid in one of the following ranges: [(2700000, 2799999)].
[C100] (INFO) Lines 19-19, sid 92001581: The rule does not use the `target` Suricata meta option. Consider adding the `target` option to specify which IP address is the target of the attack.
[S800] (INFO) Lines 19-19, sid 92001581: The rule did not specify the `attack_target` metadata option. Consider specifying the `attack_target` metadata option to help analysts interpret alerts raised by this rule.
[S801] (INFO) Lines 19-19, sid 92001581: The rule did not specify the `signature_severity` metadata option. Consider specifying the `signature_severity` metadata option to help analysts interpret alerts raised by this rule.
[S802] (INFO) Lines 19-19, sid 92001581: The rule did not specify the `performance_impact` metadata option. Consider specifying the `performance_impact` metadata option to help SOCs determine when to enable this rule.
[S803] (INFO) Lines 19-19, sid 92001581: The rule did not specify the `deployment` metadata option. Consider specifying the `deployment` metadata option to help SOCs determine when to enable this rule.
[S020] (INFO) Lines 19-19, sid 92001581: The detection logic does not use the content option, which is can cause significant runtime overhead. Consider adding a content match.
[S303] (INFO) Lines 19-19, sid 92001581: Allocation to unallocated SID range, whereas a reserved range should be used. Consider using an sid in one of the following ranges: [(2700000, 2799999)].
[S103] (INFO) Lines 19-19, sid 92001581: The rule contains unneccessary whitespace before the colon (:) after an option name. Consider removing the unneccessary whitespace.
[C100] (INFO) Lines 21-21, sid 92002992: The rule does not use the `target` Suricata meta option. Consider adding the `target` option to specify which IP address is the target of the attack.
[S800] (INFO) Lines 21-21, sid 92002992: The rule did not specify the `attack_target` metadata option. Consider specifying the `attack_target` metadata option to help analysts interpret alerts raised by this rule.
[S801] (INFO) Lines 21-21, sid 92002992: The rule did not specify the `signature_severity` metadata option. Consider specifying the `signature_severity` metadata option to help analysts interpret alerts raised by this rule.
[S802] (INFO) Lines 21-21, sid 92002992: The rule did not specify the `performance_impact` metadata option. Consider specifying the `performance_impact` metadata option to help SOCs determine when to enable this rule.
[S803] (INFO) Lines 21-21, sid 92002992: The rule did not specify the `deployment` metadata option. Consider specifying the `deployment` metadata option to help SOCs determine when to enable this rule.
[S402] (INFO) Lines 21-21, sid 92002992: The rule uses vague keywords such as possible or unknown in the msg field. Consider rephrasing to provide a more clear message for interpreting generated alerts.
[S020] (INFO) Lines 21-21, sid 92002992: The detection logic does not use the content option, which is can cause significant runtime overhead. Consider adding a content match.
[S303] (INFO) Lines 21-21, sid 92002992: Allocation to unallocated SID range, whereas a reserved range should be used. Consider using an sid in one of the following ranges: [(2700000, 2799999)].
[S103] (INFO) Lines 21-21, sid 92002992: The rule contains unneccessary whitespace before the colon (:) after an option name. Consider removing the unneccessary whitespace.
[C100] (INFO) Lines 23-23, sid 92002993: The rule does not use the `target` Suricata meta option. Consider adding the `target` option to specify which IP address is the target of the attack.
[S800] (INFO) Lines 23-23, sid 92002993: The rule did not specify the `attack_target` metadata option. Consider specifying the `attack_target` metadata option to help analysts interpret alerts raised by this rule.
[S801] (INFO) Lines 23-23, sid 92002993: The rule did not specify the `signature_severity` metadata option. Consider specifying the `signature_severity` metadata option to help analysts interpret alerts raised by this rule.
[S802] (INFO) Lines 23-23, sid 92002993: The rule did not specify the `performance_impact` metadata option. Consider specifying the `performance_impact` metadata option to help SOCs determine when to enable this rule.
[S803] (INFO) Lines 23-23, sid 92002993: The rule did not specify the `deployment` metadata option. Consider specifying the `deployment` metadata option to help SOCs determine when to enable this rule.
[S402] (INFO) Lines 23-23, sid 92002993: The rule uses vague keywords such as possible or unknown in the msg field. Consider rephrasing to provide a more clear message for interpreting generated alerts.
[S020] (INFO) Lines 23-23, sid 92002993: The detection logic does not use the content option, which is can cause significant runtime overhead. Consider adding a content match.
[S303] (INFO) Lines 23-23, sid 92002993: Allocation to unallocated SID range, whereas a reserved range should be used. Consider using an sid in one of the following ranges: [(2700000, 2799999)].
[S103] (INFO) Lines 23-23, sid 92002993: The rule contains unneccessary whitespace before the colon (:) after an option name. Consider removing the unneccessary whitespace.
[C100] (INFO) Lines 25-25, sid 92002994: The rule does not use the `target` Suricata meta option. Consider adding the `target` option to specify which IP address is the target of the attack.
[S800] (INFO) Lines 25-25, sid 92002994: The rule did not specify the `attack_target` metadata option. Consider specifying the `attack_target` metadata option to help analysts interpret alerts raised by this rule.
[S801] (INFO) Lines 25-25, sid 92002994: The rule did not specify the `signature_severity` metadata option. Consider specifying the `signature_severity` metadata option to help analysts interpret alerts raised by this rule.
[S802] (INFO) Lines 25-25, sid 92002994: The rule did not specify the `performance_impact` metadata option. Consider specifying the `performance_impact` metadata option to help SOCs determine when to enable this rule.
[S803] (INFO) Lines 25-25, sid 92002994: The rule did not specify the `deployment` metadata option. Consider specifying the `deployment` metadata option to help SOCs determine when to enable this rule.
[S402] (INFO) Lines 25-25, sid 92002994: The rule uses vague keywords such as possible or unknown in the msg field. Consider rephrasing to provide a more clear message for interpreting generated alerts.
[S020] (INFO) Lines 25-25, sid 92002994: The detection logic does not use the content option, which is can cause significant runtime overhead. Consider adding a content match.
[S303] (INFO) Lines 25-25, sid 92002994: Allocation to unallocated SID range, whereas a reserved range should be used. Consider using an sid in one of the following ranges: [(2700000, 2799999)].
[S103] (INFO) Lines 25-25, sid 92002994: The rule contains unneccessary whitespace before the colon (:) after an option name. Consider removing the unneccessary whitespace.
[C100] (INFO) Lines 27-27, sid 92002995: The rule does not use the `target` Suricata meta option. Consider adding the `target` option to specify which IP address is the target of the attack.
[S800] (INFO) Lines 27-27, sid 92002995: The rule did not specify the `attack_target` metadata option. Consider specifying the `attack_target` metadata option to help analysts interpret alerts raised by this rule.
[S801] (INFO) Lines 27-27, sid 92002995: The rule did not specify the `signature_severity` metadata option. Consider specifying the `signature_severity` metadata option to help analysts interpret alerts raised by this rule.
[S802] (INFO) Lines 27-27, sid 92002995: The rule did not specify the `performance_impact` metadata option. Consider specifying the `performance_impact` metadata option to help SOCs determine when to enable this rule.
[S803] (INFO) Lines 27-27, sid 92002995: The rule did not specify the `deployment` metadata option. Consider specifying the `deployment` metadata option to help SOCs determine when to enable this rule.
[S402] (INFO) Lines 27-27, sid 92002995: The rule uses vague keywords such as possible or unknown in the msg field. Consider rephrasing to provide a more clear message for interpreting generated alerts.
[S020] (INFO) Lines 27-27, sid 92002995: The detection logic does not use the content option, which is can cause significant runtime overhead. Consider adding a content match.
[S303] (INFO) Lines 27-27, sid 92002995: Allocation to unallocated SID range, whereas a reserved range should be used. Consider using an sid in one of the following ranges: [(2700000, 2799999)].
[S103] (INFO) Lines 27-27, sid 92002995: The rule contains unneccessary whitespace before the colon (:) after an option name. Consider removing the unneccessary whitespace.
[C100] (INFO) Lines 29-29, sid 92010936: The rule does not use the `target` Suricata meta option. Consider adding the `target` option to specify which IP address is the target of the attack.
[S800] (INFO) Lines 29-29, sid 92010936: The rule did not specify the `attack_target` metadata option. Consider specifying the `attack_target` metadata option to help analysts interpret alerts raised by this rule.
[S801] (INFO) Lines 29-29, sid 92010936: The rule did not specify the `signature_severity` metadata option. Consider specifying the `signature_severity` metadata option to help analysts interpret alerts raised by this rule.
[S802] (INFO) Lines 29-29, sid 92010936: The rule did not specify the `performance_impact` metadata option. Consider specifying the `performance_impact` metadata option to help SOCs determine when to enable this rule.
[S803] (INFO) Lines 29-29, sid 92010936: The rule did not specify the `deployment` metadata option. Consider specifying the `deployment` metadata option to help SOCs determine when to enable this rule.
[S020] (INFO) Lines 29-29, sid 92010936: The detection logic does not use the content option, which is can cause significant runtime overhead. Consider adding a content match.
[S303] (INFO) Lines 29-29, sid 92010936: Allocation to unallocated SID range, whereas a reserved range should be used. Consider using an sid in one of the following ranges: [(2700000, 2799999)].
[S103] (INFO) Lines 29-29, sid 92010936: The rule contains unneccessary whitespace before the colon (:) after an option name. Consider removing the unneccessary whitespace.
[C100] (INFO) Lines 31-31, sid 92018489: The rule does not use the `target` Suricata meta option. Consider adding the `target` option to specify which IP address is the target of the attack.
[S800] (INFO) Lines 31-31, sid 92018489: The rule did not specify the `attack_target` metadata option. Consider specifying the `attack_target` metadata option to help analysts interpret alerts raised by this rule.
[S801] (INFO) Lines 31-31, sid 92018489: The rule did not specify the `signature_severity` metadata option. Consider specifying the `signature_severity` metadata option to help analysts interpret alerts raised by this rule.
[S802] (INFO) Lines 31-31, sid 92018489: The rule did not specify the `performance_impact` metadata option. Consider specifying the `performance_impact` metadata option to help SOCs determine when to enable this rule.
[S803] (INFO) Lines 31-31, sid 92018489: The rule did not specify the `deployment` metadata option. Consider specifying the `deployment` metadata option to help SOCs determine when to enable this rule.
[S210] (INFO) Lines 31-31, sid 92018489: The rule body contains a content matches modified by depth or offset that is not the first content match. Consider moving the modified content match to the beginning of the detection options.
[S303] (INFO) Lines 31-31, sid 92018489: Allocation to unallocated SID range, whereas a reserved range should be used. Consider using an sid in one of the following ranges: [(2700000, 2799999)].
[C100] (INFO) Lines 33-33, sid 92010937: The rule does not use the `target` Suricata meta option. Consider adding the `target` option to specify which IP address is the target of the attack.
[S800] (INFO) Lines 33-33, sid 92010937: The rule did not specify the `attack_target` metadata option. Consider specifying the `attack_target` metadata option to help analysts interpret alerts raised by this rule.
[S801] (INFO) Lines 33-33, sid 92010937: The rule did not specify the `signature_severity` metadata option. Consider specifying the `signature_severity` metadata option to help analysts interpret alerts raised by this rule.
[S802] (INFO) Lines 33-33, sid 92010937: The rule did not specify the `performance_impact` metadata option. Consider specifying the `performance_impact` metadata option to help SOCs determine when to enable this rule.
[S803] (INFO) Lines 33-33, sid 92010937: The rule did not specify the `deployment` metadata option. Consider specifying the `deployment` metadata option to help SOCs determine when to enable this rule.
[S020] (INFO) Lines 33-33, sid 92010937: The detection logic does not use the content option, which is can cause significant runtime overhead. Consider adding a content match.
[S303] (INFO) Lines 33-33, sid 92010937: Allocation to unallocated SID range, whereas a reserved range should be used. Consider using an sid in one of the following ranges: [(2700000, 2799999)].
[S103] (INFO) Lines 33-33, sid 92010937: The rule contains unneccessary whitespace before the colon (:) after an option name. Consider removing the unneccessary whitespace.
[C100] (INFO) Lines 35-35, sid 92010939: The rule does not use the `target` Suricata meta option. Consider adding the `target` option to specify which IP address is the target of the attack.
[S800] (INFO) Lines 35-35, sid 92010939: The rule did not specify the `attack_target` metadata option. Consider specifying the `attack_target` metadata option to help analysts interpret alerts raised by this rule.
[S801] (INFO) Lines 35-35, sid 92010939: The rule did not specify the `signature_severity` metadata option. Consider specifying the `signature_severity` metadata option to help analysts interpret alerts raised by this rule.
[S802] (INFO) Lines 35-35, sid 92010939: The rule did not specify the `performance_impact` metadata option. Consider specifying the `performance_impact` metadata option to help SOCs determine when to enable this rule.
[S803] (INFO) Lines 35-35, sid 92010939: The rule did not specify the `deployment` metadata option. Consider specifying the `deployment` metadata option to help SOCs determine when to enable this rule.
[S020] (INFO) Lines 35-35, sid 92010939: The detection logic does not use the content option, which is can cause significant runtime overhead. Consider adding a content match.
[S303] (INFO) Lines 35-35, sid 92010939: Allocation to unallocated SID range, whereas a reserved range should be used. Consider using an sid in one of the following ranges: [(2700000, 2799999)].
[S103] (INFO) Lines 35-35, sid 92010939: The rule contains unneccessary whitespace before the colon (:) after an option name. Consider removing the unneccessary whitespace.
[C100] (INFO) Lines 37-37, sid 92001219: The rule does not use the `target` Suricata meta option. Consider adding the `target` option to specify which IP address is the target of the attack.
[S800] (INFO) Lines 37-37, sid 92001219: The rule did not specify the `attack_target` metadata option. Consider specifying the `attack_target` metadata option to help analysts interpret alerts raised by this rule.
[S801] (INFO) Lines 37-37, sid 92001219: The rule did not specify the `signature_severity` metadata option. Consider specifying the `signature_severity` metadata option to help analysts interpret alerts raised by this rule.
[S802] (INFO) Lines 37-37, sid 92001219: The rule did not specify the `performance_impact` metadata option. Consider specifying the `performance_impact` metadata option to help SOCs determine when to enable this rule.
[S803] (INFO) Lines 37-37, sid 92001219: The rule did not specify the `deployment` metadata option. Consider specifying the `deployment` metadata option to help SOCs determine when to enable this rule.
[S020] (INFO) Lines 37-37, sid 92001219: The detection logic does not use the content option, which is can cause significant runtime overhead. Consider adding a content match.
[S303] (INFO) Lines 37-37, sid 92001219: Allocation to unallocated SID range, whereas a reserved range should be used. Consider using an sid in one of the following ranges: [(2700000, 2799999)].
[S103] (INFO) Lines 37-37, sid 92001219: The rule contains unneccessary whitespace before the colon (:) after an option name. Consider removing the unneccessary whitespace.
[C100] (INFO) Lines 39-39, sid 92002910: The rule does not use the `target` Suricata meta option. Consider adding the `target` option to specify which IP address is the target of the attack.
[S800] (INFO) Lines 39-39, sid 92002910: The rule did not specify the `attack_target` metadata option. Consider specifying the `attack_target` metadata option to help analysts interpret alerts raised by this rule.
[S801] (INFO) Lines 39-39, sid 92002910: The rule did not specify the `signature_severity` metadata option. Consider specifying the `signature_severity` metadata option to help analysts interpret alerts raised by this rule.
[S802] (INFO) Lines 39-39, sid 92002910: The rule did not specify the `performance_impact` metadata option. Consider specifying the `performance_impact` metadata option to help SOCs determine when to enable this rule.
[S803] (INFO) Lines 39-39, sid 92002910: The rule did not specify the `deployment` metadata option. Consider specifying the `deployment` metadata option to help SOCs determine when to enable this rule.
[S020] (INFO) Lines 39-39, sid 92002910: The detection logic does not use the content option, which is can cause significant runtime overhead. Consider adding a content match.
[S303] (INFO) Lines 39-39, sid 92002910: Allocation to unallocated SID range, whereas a reserved range should be used. Consider using an sid in one of the following ranges: [(2700000, 2799999)].
[C100] (INFO) Lines 41-41, sid 92002911: The rule does not use the `target` Suricata meta option. Consider adding the `target` option to specify which IP address is the target of the attack.
[S800] (INFO) Lines 41-41, sid 92002911: The rule did not specify the `attack_target` metadata option. Consider specifying the `attack_target` metadata option to help analysts interpret alerts raised by this rule.
[S801] (INFO) Lines 41-41, sid 92002911: The rule did not specify the `signature_severity` metadata option. Consider specifying the `signature_severity` metadata option to help analysts interpret alerts raised by this rule.
[S802] (INFO) Lines 41-41, sid 92002911: The rule did not specify the `performance_impact` metadata option. Consider specifying the `performance_impact` metadata option to help SOCs determine when to enable this rule.
[S803] (INFO) Lines 41-41, sid 92002911: The rule did not specify the `deployment` metadata option. Consider specifying the `deployment` metadata option to help SOCs determine when to enable this rule.
[S020] (INFO) Lines 41-41, sid 92002911: The detection logic does not use the content option, which is can cause significant runtime overhead. Consider adding a content match.
[S303] (INFO) Lines 41-41, sid 92002911: Allocation to unallocated SID range, whereas a reserved range should be used. Consider using an sid in one of the following ranges: [(2700000, 2799999)].
[S103] (INFO) Lines 41-41, sid 92002911: The rule contains unneccessary whitespace before the colon (:) after an option name. Consider removing the unneccessary whitespace.
[C100] (INFO) Lines 43-43, sid 92009714: The rule does not use the `target` Suricata meta option. Consider adding the `target` option to specify which IP address is the target of the attack.
[S802] (INFO) Lines 43-43, sid 92009714: The rule did not specify the `performance_impact` metadata option. Consider specifying the `performance_impact` metadata option to help SOCs determine when to enable this rule.
[S402] (INFO) Lines 43-43, sid 92009714: The rule uses vague keywords such as possible or unknown in the msg field. Consider rephrasing to provide a more clear message for interpreting generated alerts.
[S303] (INFO) Lines 43-43, sid 92009714: Allocation to unallocated SID range, whereas a reserved range should be used. Consider using an sid in one of the following ranges: [(2700000, 2799999)].
[S500] (INFO) Lines 43-43, sid 92009714: The rule specifies the connection state after the connection direction in the `flow` option. Consider specifying the connection state first like `established,to_server`.
[S120] (INFO) Lines 43-43, sid 92009714: The rule did not escape (\x3a\x3b\x20\x22\x27\x7b\x7c\x5c\x2f\x60\x24\x28\x29) in a content field. Consider using hex encoding instead.
Total issues found: 155
Rules with Issues found: 22 |
/u/507029/crop56967733a9fb9_cropped.png?f=community)
:strip_icc():strip_exif()/u/3228/crop5d113bdb41aeb_cropped.jpeg?f=community)
:strip_exif()/u/30814/newgot.gif?f=community)
:strip_exif()/u/1417624/crop5ef9d1ffc9c03_cropped.gif?f=community)
:strip_exif()/f/image/deckh8IvOLtFNWKZygY2rlGP.png?f=user_large)
/u/211309/crop61b0ff95cd8ef.png?f=community)
:strip_icc():strip_exif()/u/1296/Bril60x60.jpg?f=community)
:strip_icc():strip_exif()/u/1007893/crop5f84470ecb79a.jpeg?f=community)
/u/224026/crop5a1c1a6fcf1b1.png?f=community)
:strip_exif()/u/169525/output_dhw4Qf.gif?f=community)
:strip_icc():strip_exif()/u/25009/crop65f1e3109d1b7_cropped.jpg?f=community)
:strip_icc():strip_exif()/u/213490/icon.jpg?f=community){kind=icon}
/u/155722/Looneytunes.png?f=community)
/u/244992/crop5f76fde777756_cropped.png?f=community)
:strip_exif()/f/image/z3PmFYrH6hUwnlGhhHHTXC4T.png?f=user_large)
:strip_icc():strip_exif()/u/227665/th_petey_rawrs.jpg?f=community)
:strip_exif()/f/image/3n9cIvQlhO7FxMSl8nmytkHk.png?f=user_large)
:strip_exif()/f/image/HtuzJz2qxZ4W5pEQCmbMw6BZ.png?f=user_large)
:strip_icc():strip_exif()/u/3730/oddball.jpg?f=community)
:strip_icc():strip_exif()/u/655118/Deltanite.jpg?f=community)
:strip_exif()/u/22345/tweakers.gif?f=community)
:strip_icc():strip_exif()/u/5964/crop56503163e97a5.jpeg?f=community)
(of had je dat al gedaan? zo ja dan negeer mijn comment)
:strip_exif()/u/47168/loop.gif?f=community)
:strip_icc():strip_exif()/u/116726/crop5e3ee297a8a03_cropped.jpeg?f=community)
/u/102105/crop56f481fe1f74f.png?f=community)
:strip_icc():strip_exif()/u/6143/rincewind.jpg?f=community)