<commit_before># Snort::Rule

Constructs and parses Snort rules similar to PERL's Snort::Rule.

## Installation

Add this line to your application's Gemfile:

    gem 'snort-rule'

And then execute:

    $ bundle

Or install it yourself as:

    $ gem install snort-rule

## Usage

	require 'snort/rule'
	rule = Snort::Rule.new({:enabled => true, :action => 'pass', :proto => 'udp', :src => '192.168.0.1', :sport => 'any', :dir => '<>', :dst => 'any', :dport => 53, :opts => {'sid' => 48, 'threshold' => 'type limit,track by_src,count 1,seconds 3600' }})

	rule.to_s => "pass udp 192.168.0.1 any <> any 53 ( sid:48; threshold:type limit,track by_src,count 1,seconds 3600; )"

	rule = Snort::Rule.new
	rule.enabled = false
	rule.action = 'pass'
	rule.proto = 'udp'
	rule.src = '192.168.0.1'
	rule.dir = '<>'
	rule.dport = 53
	rule.options << Snort::RuleOption.new('sid', 48)
	rule.options << Snort::RuleOption.new('threshold', 'type limit,track by_src,count 1,seconds 3600')
	rule.options << Snort::RuleOption.new('ref', 'ref1')
	rule.options << Snort::RuleOption.new('ref', 'ref2')
	rule.options.each do |opt|
		puts opt
	end
	rule.options_hash["sid"] == 48
	rule.options_hash["ref"] == "ref2"

	# if the rule is disabled, then it will begin with a #
	rule.to_s => "#pass udp 192.168.0.1 any <> any 53 ( sid:48; threshold:type limit,track by_src,count 1,seconds 3600; )"

	rule = Snort::Rule.parse("pass udp 192.168.0.1 any <> any 53 ( sid:48; threshold:type limit,track by_src,count 1,seconds 3600; )")
	rule.to_s => "pass udp 192.168.0.1 any <> any 53 ( sid:48; threshold:type limit,track by_src,count 1,seconds 3600; )"

## Contributing

1. Fork it
2. Create your feature branch (`git checkout -b my-new-feature`)
3. Commit your changes (`git commit -am 'Add some feature'`)
4. Push to the branch (`git push origin my-new-feature`)
5. Create new Pull Request

Thanks so much for those who have already contributed.

<a href='mailto:<EMAIL>@chrislee[dot]dhs[dot]org[stop here]xxx'><img src='http://chrisleephd.us/images/github-email.png?snort-rule'></a><commit_msg>updated readme a touch<commit_after># Snort::Rule

Constructs and parses Snort rules similar to PERL's Snort::Rule.

## Installation

Add this line to your application's Gemfile:

    gem 'snort-rule'

And then execute:

    $ bundle

Or install it yourself as:

    $ gem install snort-rule

## Usage

	require 'snort/rule'
	rule = Snort::Rule.new({:enabled => true, :action => 'pass', :proto => 'udp', :src => '192.168.0.1', :sport => 'any', :dir => '<>', :dst => 'any', :dport => 53, :opts => {'sid' => 48, 'threshold' => 'type limit,track by_src,count 1,seconds 3600' }})

	rule.to_s => "pass udp 192.168.0.1 any <> any 53 ( sid:48; threshold:type limit,track by_src,count 1,seconds 3600; )"

	rule = Snort::Rule.new
	rule.enabled = false
	rule.action = 'pass'
	rule.proto = 'udp'
	rule.src = '192.168.0.1'
	rule.dir = '<>'
	rule.dport = 53
	rule.options << Snort::RuleOption.new('sid', 48)
	rule.options << Snort::RuleOption.new('threshold', 'type limit,track by_src,count 1,seconds 3600')
	rule.options << Snort::RuleOption.new('ref', 'ref1')
	rule.options << Snort::RuleOption.new('ref', 'ref2')
	rule.options.each do |opt|
		puts opt
	end
	rule.options_hash["sid"] == 48
	rule.options_hash["ref"] == "ref2"

	# if the rule is disabled, then it will begin with a #
	rule.to_s => "#pass udp 192.168.0.1 any <> any 53 ( sid:48; threshold:type limit,track by_src,count 1,seconds 3600;  ref:ref1; ref:ref2;)"

	rule = Snort::Rule.parse("pass udp 192.168.0.1 any <> any 53 ( sid:48; threshold:type limit,track by_src,count 1,seconds 3600;  ref:ref1; ref:ref2;)")
	rule.to_s => "pass udp 192.168.0.1 any <> any 53 ( sid:48; threshold:type limit,track by_src,count 1,seconds 3600;  ref:ref1; ref:ref2;)"

## Contributing

1. Fork it
2. Create your feature branch (`git checkout -b my-new-feature`)
3. Commit your changes (`git commit -am 'Add some feature'`)
4. Push to the branch (`git push origin my-new-feature`)
5. Create new Pull Request

Thanks so much for those who have already contributed.

<a href='mailto:<EMAIL>[dot]dhs[dot]org[stop here]xxx'><img src='http://chrisleephd.us/images/github-email.png?snort-rule'></a>
{'fraction_non_alphanumeric': 0.16905102527420124, 'fraction_numerical': 0.05484024797329518, 'mean_word_length': 4.392030848329049, 'pattern_counts': {'":': 0, '<': 39, '<?xml version=': 0, '>': 51, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 12, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5945904', 'n_tokens_mistral': 1716, 'n_tokens_neox': 1527, 'n_words': 434}