IDS Rules

The IDS Rules page extracts Suricata or Snort rules from honeypot signatures captured by Cowrie (HASSH) and Dionaea (JA3, JA3S). You can filter signatures by date range and honeypot type, preview the generated rules in either format, and export them for deployment to a Suricata or Snort IDS.

Accessing IDS Rules

IDS Rules

To access the IDS Rules page, click IDS Rules in the Security Tools section of the left menu sidebar.

Extracting Signatures

To extract signatures and generate rules:

  1. Set the Date Range (from and to) to define the time window for signature extraction
  2. Select Honeypot Type: Cowrie, Dionaea, or All
  3. Select Rule Types: HASSH (SSH fingerprints from Cowrie), JA3, JA3S (TLS fingerprints from Dionaea), ssh_software (SSH client version from Cowrie)
  4. Click [Extract Signatures]

The results table displays each unique signature with:

  • Type - hassh, ja3, ja3s, or ssh_software
  • Hash - The fingerprint value
  • Source - Honeypot that captured it (cowrie or dionaea)
  • Count - Number of times observed
  • First Seen - Earliest observation timestamp

Exporting Rules

After extracting signatures:

  1. Optionally expand the Preview Rules section and use the Suricata / Snort tabs to switch format
  2. View and edit the generated rules before export if desired
  3. Click [Export Rules] to download a .rules file (uses your edited content if you made changes in the preview)
  4. Click [Copy to Clipboard] to copy the rules text without downloading
  5. Suricata format: stingar-honeypot.rules; Snort format: stingar-honeypot-snort.rules

Auto-generated Feed

IDS devices can pull rules from a stable feed URL. A background job periodically regenerates rules from Elasticsearch and writes them to a cache file. Configure the feed from the IDS Rules page:

  1. Use the Feed date range selector (30d, 7d, 24h, 12h, 3h, 1h) to set the lookback window for the auto-generated rules
  2. The selection is persisted to IDS_RULES_FEED_DATE_RANGE in stingar.env and takes effect on the next background job run
  3. The page displays the last-generated timestamp and signature counts when available

The background job writes both Suricata and Snort cache files. Use the format parameter to pull the desired rules:

  • Suricata: GET /api/v2/ids-rules/feed?format=suricata
  • Snort: GET /api/v2/ids-rules/feed?format=snort

If the cache does not exist yet (e.g., before the first job run), the endpoint returns 503 with a Retry-After header. The response includes Cache-Control: max-age=300 for client caching.

Deploying Rules

Suricata: Copy stingar-honeypot.rules to your Suricata rules directory (e.g., /etc/suricata/rules/).

Snort: Copy stingar-honeypot-snort.rules to your Snort rules directory. Snort rules use ja3_hash and ja3s_hash keywords for compatibility with Cisco Firepower, Check Point, and FortiConverter.

Manual deployment steps (Suricata):

  1. Copy the exported file to your Suricata rules directory
  2. Run suricata -T to validate the rules syntax
  3. If using suricata-update for local rules: run suricata-update --local to include the new rules
  4. Reload Suricata to apply the new rules (method depends on your deployment: systemctl reload suricata, kill -USR2 <pid>, or restart the Suricata process)

Configuration

The following environment variables control the auto-generated feed (configurable via Environment Variables Settings or stingar.env):

  • IDS_RULES_AUTO_UPDATE_ENABLED - Enable or disable the background job (default: true)
  • IDS_RULES_AUTO_UPDATE_INTERVAL - Interval in seconds between rule regenerations (default: 300)
  • IDS_RULES_CACHE_PATH - Path to the Suricata cached rules file (default: /var/lib/stingar/ids-rules/stingar-honeypot.rules). The Snort cache is written to stingar-honeypot-snort.rules in the same directory.
  • IDS_RULES_FEED_DATE_RANGE - Lookback window for the feed (30d, 7d, 24h, 12h, 3h, 1h; default: 30d)

Ensure IDS_RULES_CACHE_PATH points to a writable directory in the Apiarist container (e.g., mount a volume for /var/lib/stingar/ids-rules/).

API Access

The IDS Rules functionality is available via the STINGAR API:

  • GET /api/v2/ids-rules - Returns extracted signatures as JSON
  • GET /api/v2/ids-rules/preview - Returns Suricata or Snort rules as text for preview (format=suricata or format=snort)
  • GET /api/v2/ids-rules/export - Returns Suricata or Snort rules file for download (format=suricata or format=snort)
  • GET /api/v2/ids-rules/feed - Returns cached rules file for IDS to pull (format=suricata or format=snort; auto-generated by background job; 503 if cache not ready)
  • GET /api/v2/ids-rules/status - Returns last generation time, signature counts, and feed URLs for both formats

All endpoints require the api-key header. See the STINGAR API documentation and Swagger (/api/v2#) for full parameter and response details.

Related Documentation