Provide access to suricata via a library-like interface. Allows packets to be sent to suricata
and alerts received.
#[tokio::main]
async fn main() {
let resources = PathBuf::from(env!("CARGO_MANIFEST_DIR"))
.parent().expect("Invalid path")
.parent().expect("Invalid path")
.join("resources");
let config = Config::default();
let rules = Rules::from_path(resources.join("test.rules")).expect("Could not parse rules");
let cache: IntelCache<Rule> = rules.into();
cache.materialize_rules(config.rule_path.clone()).expect("Failed to materialize rules");
let mut ids = Ids::new(config).await.expect("Failed to create ids");
let ids_alerts = ids.take_alerts().expect("No alerts");
send_packets(&mut ids).await.expect("Failed to send packets");
let alerts: Result<Vec<_>, Error> = ids_alerts.try_collect().await;
let alerts: Result<Vec<_>, Error> = alerts.expect("Failed to receive alerts")
.into_iter().flat_map(|v| v).collect();
let alerts = alerts.expect("Failed to parse alerts");
for eve in alerts {
println!("Eve={:?}", eve);
if let Some(intel) = cache.observed(eve) {
if let Observed::Alert { rule, message: _ } = intel {
println!("Rule={:?}", rule);
}
}
}
}