Snort::Rule

gem 'snort-rule'

$ bundle

$ gem install snort-rule

require 'snort/rule'
rule = Snort::Rule.new({:enabled => true, :action => 'pass', :proto => 'udp', :src => '192.168.0.1', :sport => 'any', :dir => '<>', :dst => 'any', :dport => 53, :options => {'sid' => 48, 'threshold' => 'type limit,track by_src,count 1,seconds 3600' }})

rule.to_s # => "pass udp 192.168.0.1 any <> any 53 ( sid:48; threshold:type limit,track by_src,count 1,seconds 3600; )"

rule = Snort::Rule.new
rule.enabled = false
rule.action = 'pass'
rule.proto = 'udp'
rule.src = '192.168.0.1'
rule.dir = '<>'
rule.dport = 53
rule.add_option(Snort::RuleOption.new('sid', 48))
rule.add_option(Snort::RuleOption.new('threshold', 'type limit,track by_src,count 1,seconds 3600'))
rule.add_option(Snort::RuleOption.new('ref', 'ref1'))
rule.add_option(Snort::RuleOption.new('ref', ['ref2', 'nocase']))
rule.options.each do |opt|
	puts opt
end
rule.options_hash["sid"][0].arguments[0] # => 48
rule.options_hash["ref"][1].arguments[0] # => "ref2"
rule.options_hash["ref"][1].arguments[1] # => "nocase"

# if the rule is disabled, then it will begin with a #
rule.to_s # => #pass udp 192.168.0.1 any <> any 53 (sid:48; threshold:type limit,track by_src,count 1,seconds 3600; sid:48; threshold:type limit,track by_src,count 1,seconds 3600; ref:ref1; ref:ref2; nocase;)"

rule = Snort::Rule.parse("pass udp 192.168.0.1 any <> any 53 ( sid:48; threshold:type limit,track by_src,count 1,seconds 3600;  ref:ref1; ref:ref2;)")
rule.to_s # => "pass udp 192.168.0.1 any <> any 53 (sid:48; threshold:type limit,track by_src,count 1,seconds 3600; ref:ref1; ref:ref2;)"

require 'snort/ruleset'
ruleset = Snort::RuleSet::from_file("community.rules")
ruleset.length # => 3127
rules.length
rules.count{|r| ! r.enabled} # => 2522
rules.count{|r| r.enabled} # => 605
rules.disable_all
rules.count{|r| r.enabled} # => 0
rules.count{|r| ! r.enabled} # => 3127
rules.enable_all
rules.count{|r| r.enabled} # => 3127
rules.count{|r| ! r.enabled} # => 0
rules.disable do |r|
  r.get_option_first("msg").match(/^"MALWARE\-CNC/)
end
rules.count{|r| ! r.enabled} # => 392
rules.count{|r| r.enabled} # => 2735
rules.delete do |r|
  options = r.get_options("content")
  if options
    options.find { |o|
      o.arguments.find { |a|
        a.match(/"POST"/)
      }
    }
  else
    nil
  end
end
rules.count{|r| ! r.enabled} # => 343
rules.count{|r| r.enabled} # 2726
rules.delete_all
rules.length # => 0
rules.count{|r| r.enabled} # => 0
rules.count{|r| ! r.enabled} # => 0

ruleset = Snort::RuleSet::from_file("community.rules")
ruleset.to_file("new_community.rules")