You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This is a major feature that's needed.
After all rules are downloaded, PP needs to have a mechanism for the rules to be modified based on user needs (changing 'alert' to 'drop' when the severity > 2 for a simple example).
This can be done with a DSL (domain specific language) and the Lark parser. Basically we create a grammar describing an individual rule, and have Lark parse each rule into a parse tree.
we then have a DSL that allows the user to write complex rules that will modify the ruleset rules. Some DSL rule examples:
disable ((gid != 1) and (metadata contains "community"))
modify (action = reject ) where (sid > 1000)
modify (dst_ports = 'https_ports' ) where ((dst_ports == "https_ports") and (flow != "to_client" ) )
The user would create a file with these commands in them, and PP would use these DSL rules to modify the rules individually.
I have code that does this, but it's not ready for primetime yet (slow when it scales up, and there are a few edge cases in the grammar describing a rule which I need to handle.
I'll create a new branch for this feature so people can test it once I iron out a few bugs.
The text was updated successfully, but these errors were encountered:
This is a major feature that's needed.
After all rules are downloaded, PP needs to have a mechanism for the rules to be modified based on user needs (changing 'alert' to 'drop' when the severity > 2 for a simple example).
This can be done with a DSL (domain specific language) and the Lark parser. Basically we create a grammar describing an individual rule, and have Lark parse each rule into a parse tree.
we then have a DSL that allows the user to write complex rules that will modify the ruleset rules. Some DSL rule examples:
The user would create a file with these commands in them, and PP would use these DSL rules to modify the rules individually.
I have code that does this, but it's not ready for primetime yet (slow when it scales up, and there are a few edge cases in the grammar describing a rule which I need to handle.
I'll create a new branch for this feature so people can test it once I iron out a few bugs.
The text was updated successfully, but these errors were encountered: