{"adoption": {"forks": 306, "observed_at": "2026-08-28T04:04:14.116565+00:00", "stars": 1283}, "canonical_url": "https://ross.abutalabs.com/products/suricata-rules", "card": {"archived": false, "artifact_type": "dataset", "description": "Suricata IDS rules 用来检测红队渗透/恶意行为等，支持检测CobaltStrike/MSF/Empire/DNS隧道/Weevely/菜刀/冰蝎/挖矿/反弹shell/ICMP隧道等", "domain": ["security", "penetration-testing", "networking"], "enriched": true, "function": ["security", "monitoring", "alerting"], "health_score": 20, "homepage": null, "language": null, "license": null, "license_family": "other", "maturity": "maintenance", "member_repos": ["al0ne/suricata-rules"], "name": "al0ne/suricata-rules", "platform": ["self-hosted"], "pushed_at": "2023-07-08T08:10:42+00:00", "repo": "al0ne/suricata-rules", "stars": 1283, "tags": ["ids", "suricata", "intrusion-detection", "network-signatures", "threat-detection", "red-team", "cobaltstrike", "dns-tunneling", "webshell", "reverse-shell", "linux", "web-server"], "topics": ["suricata", "suricata-rule", "ids", "signatures", "security"], "urls": [], "use_cases": ["detect cobalt strike beacon traffic with suricata", "ids rules for dns tunneling detection", "suricata signatures for webshell activity", "alert on reverse shell connections", "detect cryptomining traffic on the network", "find metasploit and empire c2 traffic", "network detection for red team tools"], "what_it_is": "A curated collection of high-quality Suricata IDS rules for detecting red-team tooling and malicious network behavior, including CobaltStrike, Metasploit, Empire, DNS/ICMP tunneling, webshells, cryptomining, and reverse shells. Each rule is organized by threat type with accompanying pcap samples for testing and validation.", "when_to_avoid": ["you use Snort rather than Suricata without adaptation", "you need continuously updated commercial-grade threat intel feeds", "you need host-based or endpoint detection rather than network signatures"], "when_to_choose": ["you run Suricata and want community-vetted signatures for common attacker tools", "you need pcap-backed rules you can test against real malicious traffic samples", "you want a single consolidated rules file covering C2, tunneling, webshells, and mining"]}, "data_as_of": "2026-08-30T08:39:29.467469+00:00", "members": [{"path": "/products/suricata-rules", "repo": "al0ne/suricata-rules", "role": "main", "score": 32}], "provenance": {"archived": {"kind": "observed", "observed_at": "2026-08-28T04:04:14.116565+00:00", "source": "github"}, "artifact_type": {"confidence": null, "enriched_at": "2026-08-30T04:56:47.826109+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "7e955c1eb390d1a830032e5be09895ec1ada9292d5f5d58716cdeebbce98692b", "fetched_at": "2026-08-28T04:04:14.116565+00:00", "kind": "readme", "missing": false, "url": "https://github.com/al0ne/suricata-rules"}], "taxonomy_version": 1}, "description": {"kind": "observed", "observed_at": "2026-08-28T04:04:14.116565+00:00", "source": "github"}, "domain": {"confidence": null, "enriched_at": "2026-08-30T04:56:47.826109+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "7e955c1eb390d1a830032e5be09895ec1ada9292d5f5d58716cdeebbce98692b", "fetched_at": "2026-08-28T04:04:14.116565+00:00", "kind": "readme", "missing": false, "url": "https://github.com/al0ne/suricata-rules"}], "taxonomy_version": 1}, "enriched": {"inputs": [], "kind": "computed", "method": "enrichment_status"}, "function": {"confidence": null, "enriched_at": "2026-08-30T04:56:47.826109+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "7e955c1eb390d1a830032e5be09895ec1ada9292d5f5d58716cdeebbce98692b", "fetched_at": "2026-08-28T04:04:14.116565+00:00", "kind": "readme", "missing": false, "url": "https://github.com/al0ne/suricata-rules"}], "taxonomy_version": 1}, "health_score": {"inputs": ["days_since_push", "days_since_release", "archived"], "kind": "computed", "method": "health_v1"}, "homepage": {"kind": "observed", "observed_at": "2026-08-28T04:04:14.116565+00:00", "source": "github"}, "language": {"kind": "observed", "observed_at": "2026-08-28T04:04:14.116565+00:00", "source": "github"}, "license": {"kind": "observed", "observed_at": "2026-08-28T04:04:14.116565+00:00", "source": "github"}, "license_family": {"inputs": ["license"], "kind": "computed", "method": "license_family"}, "maturity": {"confidence": null, "enriched_at": "2026-08-30T04:56:47.826109+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "7e955c1eb390d1a830032e5be09895ec1ada9292d5f5d58716cdeebbce98692b", "fetched_at": "2026-08-28T04:04:14.116565+00:00", "kind": "readme", "missing": false, "url": "https://github.com/al0ne/suricata-rules"}], "taxonomy_version": 1}, "member_repos": {"kind": "observed", "observed_at": "2026-08-28T04:04:14.116565+00:00", "source": "github"}, "name": {"kind": "observed", "observed_at": "2026-08-28T04:04:14.116565+00:00", "source": "github"}, "platform": {"confidence": null, "enriched_at": "2026-08-30T04:56:47.826109+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "7e955c1eb390d1a830032e5be09895ec1ada9292d5f5d58716cdeebbce98692b", "fetched_at": "2026-08-28T04:04:14.116565+00:00", "kind": "readme", "missing": false, "url": "https://github.com/al0ne/suricata-rules"}], "taxonomy_version": 1}, "pushed_at": {"kind": "observed", "observed_at": "2026-08-28T04:04:14.116565+00:00", "source": "github"}, "repo": {"kind": "observed", "observed_at": "2026-08-28T04:04:14.116565+00:00", "source": "github"}, "stars": {"kind": "observed", "observed_at": "2026-08-28T04:04:14.116565+00:00", "source": "github"}, "tags": {"confidence": null, "enriched_at": "2026-08-30T04:56:47.826109+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "7e955c1eb390d1a830032e5be09895ec1ada9292d5f5d58716cdeebbce98692b", "fetched_at": "2026-08-28T04:04:14.116565+00:00", "kind": "readme", "missing": false, "url": "https://github.com/al0ne/suricata-rules"}], "taxonomy_version": 1}, "topics": {"kind": "observed", "observed_at": "2026-08-28T04:04:14.116565+00:00", "source": "github"}, "urls": {"kind": "observed", "observed_at": "2026-08-28T04:04:14.116565+00:00", "source": "github"}, "use_cases": {"confidence": null, "enriched_at": "2026-08-30T04:56:47.826109+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "7e955c1eb390d1a830032e5be09895ec1ada9292d5f5d58716cdeebbce98692b", "fetched_at": "2026-08-28T04:04:14.116565+00:00", "kind": "readme", "missing": false, "url": "https://github.com/al0ne/suricata-rules"}], "taxonomy_version": 1}, "what_it_is": {"confidence": null, "enriched_at": "2026-08-30T04:56:47.826109+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "7e955c1eb390d1a830032e5be09895ec1ada9292d5f5d58716cdeebbce98692b", "fetched_at": "2026-08-28T04:04:14.116565+00:00", "kind": "readme", "missing": false, "url": "https://github.com/al0ne/suricata-rules"}], "taxonomy_version": 1}, "when_to_avoid": {"confidence": null, "enriched_at": "2026-08-30T04:56:47.826109+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "7e955c1eb390d1a830032e5be09895ec1ada9292d5f5d58716cdeebbce98692b", "fetched_at": "2026-08-28T04:04:14.116565+00:00", "kind": "readme", "missing": false, "url": "https://github.com/al0ne/suricata-rules"}], "taxonomy_version": 1}, "when_to_choose": {"confidence": null, "enriched_at": "2026-08-30T04:56:47.826109+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "7e955c1eb390d1a830032e5be09895ec1ada9292d5f5d58716cdeebbce98692b", "fetched_at": "2026-08-28T04:04:14.116565+00:00", "kind": "readme", "missing": false, "url": "https://github.com/al0ne/suricata-rules"}], "taxonomy_version": 1}}, "score": {"components": {"activity": 0, "longevity": 100, "rhythm": 35}, "computed_at": "2026-09-02T17:46:02.011165+00:00", "flags": ["no_releases", "no_license"], "formula": "round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)", "inputs": {"age_days": 2911, "days_push": 1152, "days_rel": null, "gap_med": null, "n_releases_24m": 0}, "score": 32, "version": 2}, "staleness": {"enrichment_outdated": false, "low_confidence": false, "scrape_days": 9, "stale_scrape": false}}