secrulekit 1.2.0__tar.gz

secrulekit-1.2.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Cherno.x
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

secrulekit-1.2.0/PKG-INFO

@@ -0,0 +1,241 @@
+Metadata-Version: 2.4
+Name: secrulekit
+Version: 1.2.0
+Summary: Parse, validate, convert, and manage YARA, Sigma, and Suricata security detection rules
+Author-email: "Cherno.x" <long544844@gmail.com>
+Maintainer-email: "Cherno.x" <long544844@gmail.com>
+License: MIT License
+        
+        Copyright (c) 2026 Cherno.x
+        
+        Permission is hereby granted, free of charge, to any person obtaining a copy
+        of this software and associated documentation files (the "Software"), to deal
+        in the Software without restriction, including without limitation the rights
+        to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+        copies of the Software, and to permit persons to whom the Software is
+        furnished to do so, subject to the following conditions:
+        
+        The above copyright notice and this permission notice shall be included in all
+        copies or substantial portions of the Software.
+        
+        THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+        IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+        FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+        AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+        LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+        OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+        SOFTWARE.
+        
+Project-URL: Homepage, https://github.com/lkop32788/SecRuleKit
+Project-URL: Documentation, https://github.com/lkop32788/SecRuleKit#readme
+Project-URL: Repository, https://github.com/lkop32788/SecRuleKit
+Project-URL: Issues, https://github.com/lkop32788/SecRuleKit/issues
+Project-URL: Changelog, https://github.com/lkop32788/SecRuleKit/blob/main/CHANGELOG.md
+Project-URL: Security Policy, https://github.com/lkop32788/SecRuleKit/blob/main/SECURITY.md
+Keywords: yara,sigma,suricata,detection-rules,security,siem,threat-hunting
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Intended Audience :: Information Technology
+Classifier: Intended Audience :: System Administrators
+Classifier: Topic :: Security
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.8
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Operating System :: OS Independent
+Classifier: Environment :: Console
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: click>=8.0
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: rich>=13.0
+Requires-Dist: typing-extensions>=4.0; python_version < "3.10"
+Provides-Extra: dev
+Requires-Dist: pytest>=7.0; extra == "dev"
+Requires-Dist: pytest-cov>=4.0; extra == "dev"
+Requires-Dist: ruff>=0.1.0; extra == "dev"
+Requires-Dist: mypy>=1.0; extra == "dev"
+Requires-Dist: types-PyYAML; extra == "dev"
+Dynamic: license-file
+
+# SecRuleKit
+
+[![PyPI version](https://badge.fury.io/py/secrulekit.svg)](https://badge.fury.io/py/secrulekit)
+[![Python 3.8+](https://img.shields.io/badge/python-3.8+-blue.svg)](https://www.python.org/downloads/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+[![CI](https://github.com/lkop32788/SecRuleKit/actions/workflows/ci.yml/badge.svg)](https://github.com/lkop32788/SecRuleKit/actions/workflows/ci.yml)
+
+A Python toolkit for parsing, validating, converting, and managing security detection rules — supporting **YARA**, **Sigma**, and **Suricata/Snort** formats.
+
+Security teams and researchers rely on SecRuleKit to validate rule syntax before deployment, convert rules across platforms, deduplicate rule libraries, and generate audit-ready reports.
+
+## Features
+
+- **Multi-format support** — Parse and validate YARA, Sigma, and Suricata rules from files, directories, or strings
+- **Format conversion** — Convert Sigma rules to YARA skeleton, Suricata, ElasticSearch Query DSL, and Splunk SPL
+- **Rule deduplication** — Fingerprint and detect duplicate/near-duplicate rules across large rule sets
+- **Metadata enrichment** — Tag rules with MITRE ATT&CK tactics/techniques, severity, and platform
+- **Batch reporting** — Export validation results as JSON, CSV, or HTML audit reports
+- **CLI interface** — Full-featured command-line tool for CI/CD pipeline integration
+- **Python API** — Clean library API for embedding in security tooling
+
+## Installation
+
+```bash
+pip install secrulekit
+```
+
+Or install from source:
+
+```bash
+git clone https://github.com/lkop32788/SecRuleKit.git
+cd secrulekit
+pip install -e ".[dev]"
+```
+
+## Quick Start
+
+### CLI
+
+```bash
+# Validate a directory of YARA rules
+secrulekit validate --format yara ./rules/yara/
+
+# Validate Sigma rules and output JSON report
+secrulekit validate --format sigma ./rules/sigma/ --report report.json
+
+# Convert Sigma rule to Splunk SPL
+secrulekit convert --to splunk ./rules/sigma/lateral_movement.yml
+
+# Deduplicate a large rule set
+secrulekit dedup --format yara ./rules/ --output ./rules_deduped/
+
+# Show rule metadata and ATT&CK mapping
+secrulekit info ./rules/sigma/t1059_powershell.yml
+```
+
+### Python API
+
+```python
+from secrulekit import YaraParser, SigmaParser, RuleValidator, RuleConverter
+
+# Parse and validate YARA rules
+parser = YaraParser()
+rules = parser.parse_directory("./rules/yara/")
+
+validator = RuleValidator()
+results = validator.validate_batch(rules)
+print(f"Valid: {results.valid_count}, Errors: {results.error_count}")
+
+# Convert Sigma to Splunk
+converter = RuleConverter()
+sigma = SigmaParser().parse_file("./rules/sigma/t1059.yml")
+splunk_query = converter.to_splunk(sigma)
+print(splunk_query)
+
+# Generate HTML report
+from secrulekit.reporters import HtmlReporter
+HtmlReporter().generate(results, output="audit_report.html")
+```
+
+## Supported Rule Formats
+
+| Format     | Parse | Validate | Convert From | Convert To |
+|------------|-------|----------|--------------|------------|
+| YARA       | ✅    | ✅       | —            | —          |
+| Sigma      | ✅    | ✅       | ✅           | ✅         |
+| Suricata   | ✅    | ✅       | —            | ✅         |
+| Snort      | ✅    | ✅       | —            | —          |
+
+## Sigma Conversion Targets
+
+| Target              | Flag          |
+|---------------------|---------------|
+| Splunk SPL          | `--to splunk` |
+| ElasticSearch Query | `--to elastic`|
+| YARA-L              | `--to yaral`  |
+| QRadar AQL          | `--to qradar` |
+| Suricata            | `--to suricata`|
+
+## CLI Reference
+
+```
+Usage: secrulekit [OPTIONS] COMMAND [ARGS]...
+
+Commands:
+  validate   Validate rule files for syntax and semantic errors
+  convert    Convert rules between formats
+  dedup      Find and remove duplicate rules
+  info       Display rule metadata and ATT&CK mapping
+  report     Generate audit reports from cached results
+  stats      Show statistics for a rule collection
+
+Options:
+  --version  Show version
+  --help     Show help
+```
+
+### `secrulekit validate`
+
+```
+Options:
+  -f, --format [yara|sigma|suricata|snort|auto]
+                  Rule format (default: auto-detect)
+  -r, --recursive  Recurse into subdirectories
+  --strict         Treat warnings as errors
+  --report FILE    Write JSON/HTML report to FILE
+  --no-color       Disable colored output
+```
+
+### `secrulekit convert`
+
+```
+Options:
+  --to [splunk|elastic|yaral|qradar|suricata]
+                  Target format (required)
+  -o, --output FILE   Write output to file (default: stdout)
+  --batch          Convert all .yml files in directory
+```
+
+## Project Structure
+
+```
+secrulekit/
+├── secrulekit/
+│   ├── parsers/
+│   │   ├── yara_parser.py       # YARA rule parser
+│   │   ├── sigma_parser.py      # Sigma rule parser
+│   │   └── suricata_parser.py   # Suricata/Snort parser
+│   ├── validators/
+│   │   └── rule_validator.py    # Multi-format validator
+│   ├── converters/
+│   │   └── converter.py         # Format conversion engine
+│   ├── reporters/
+│   │   ├── json_reporter.py     # JSON output
+│   │   └── html_reporter.py     # HTML audit report
+│   ├── utils/
+│   │   └── helpers.py           # Fingerprinting, dedup, ATT&CK mapping
+│   └── cli.py                   # CLI entry point
+├── tests/
+├── rules/                       # Example rule sets
+│   ├── yara/
+│   └── sigma/
+└── docs/
+```
+
+## Contributing
+
+Contributions are welcome! Please read [CONTRIBUTING.md](CONTRIBUTING.md) before opening a pull request.
+
+## Security
+
+To report a security vulnerability in SecRuleKit itself (e.g., rule parsing that could cause denial-of-service or arbitrary code execution via crafted rule files), please follow the process in [SECURITY.md](SECURITY.md).
+
+**Security Maintainer:** [@lkop32788](https://github.com/lkop32788)
+
+## License
+
+MIT © 2026 Cherno.x — see [LICENSE](LICENSE).

secrulekit-1.2.0/README.md

@@ -0,0 +1,178 @@
+# SecRuleKit
+
+[![PyPI version](https://badge.fury.io/py/secrulekit.svg)](https://badge.fury.io/py/secrulekit)
+[![Python 3.8+](https://img.shields.io/badge/python-3.8+-blue.svg)](https://www.python.org/downloads/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+[![CI](https://github.com/lkop32788/SecRuleKit/actions/workflows/ci.yml/badge.svg)](https://github.com/lkop32788/SecRuleKit/actions/workflows/ci.yml)
+
+A Python toolkit for parsing, validating, converting, and managing security detection rules — supporting **YARA**, **Sigma**, and **Suricata/Snort** formats.
+
+Security teams and researchers rely on SecRuleKit to validate rule syntax before deployment, convert rules across platforms, deduplicate rule libraries, and generate audit-ready reports.
+
+## Features
+
+- **Multi-format support** — Parse and validate YARA, Sigma, and Suricata rules from files, directories, or strings
+- **Format conversion** — Convert Sigma rules to YARA skeleton, Suricata, ElasticSearch Query DSL, and Splunk SPL
+- **Rule deduplication** — Fingerprint and detect duplicate/near-duplicate rules across large rule sets
+- **Metadata enrichment** — Tag rules with MITRE ATT&CK tactics/techniques, severity, and platform
+- **Batch reporting** — Export validation results as JSON, CSV, or HTML audit reports
+- **CLI interface** — Full-featured command-line tool for CI/CD pipeline integration
+- **Python API** — Clean library API for embedding in security tooling
+
+## Installation
+
+```bash
+pip install secrulekit
+```
+
+Or install from source:
+
+```bash
+git clone https://github.com/lkop32788/SecRuleKit.git
+cd secrulekit
+pip install -e ".[dev]"
+```
+
+## Quick Start
+
+### CLI
+
+```bash
+# Validate a directory of YARA rules
+secrulekit validate --format yara ./rules/yara/
+
+# Validate Sigma rules and output JSON report
+secrulekit validate --format sigma ./rules/sigma/ --report report.json
+
+# Convert Sigma rule to Splunk SPL
+secrulekit convert --to splunk ./rules/sigma/lateral_movement.yml
+
+# Deduplicate a large rule set
+secrulekit dedup --format yara ./rules/ --output ./rules_deduped/
+
+# Show rule metadata and ATT&CK mapping
+secrulekit info ./rules/sigma/t1059_powershell.yml
+```
+
+### Python API
+
+```python
+from secrulekit import YaraParser, SigmaParser, RuleValidator, RuleConverter
+
+# Parse and validate YARA rules
+parser = YaraParser()
+rules = parser.parse_directory("./rules/yara/")
+
+validator = RuleValidator()
+results = validator.validate_batch(rules)
+print(f"Valid: {results.valid_count}, Errors: {results.error_count}")
+
+# Convert Sigma to Splunk
+converter = RuleConverter()
+sigma = SigmaParser().parse_file("./rules/sigma/t1059.yml")
+splunk_query = converter.to_splunk(sigma)
+print(splunk_query)
+
+# Generate HTML report
+from secrulekit.reporters import HtmlReporter
+HtmlReporter().generate(results, output="audit_report.html")
+```
+
+## Supported Rule Formats
+
+| Format     | Parse | Validate | Convert From | Convert To |
+|------------|-------|----------|--------------|------------|
+| YARA       | ✅    | ✅       | —            | —          |
+| Sigma      | ✅    | ✅       | ✅           | ✅         |
+| Suricata   | ✅    | ✅       | —            | ✅         |
+| Snort      | ✅    | ✅       | —            | —          |
+
+## Sigma Conversion Targets
+
+| Target              | Flag          |
+|---------------------|---------------|
+| Splunk SPL          | `--to splunk` |
+| ElasticSearch Query | `--to elastic`|
+| YARA-L              | `--to yaral`  |
+| QRadar AQL          | `--to qradar` |
+| Suricata            | `--to suricata`|
+
+## CLI Reference
+
+```
+Usage: secrulekit [OPTIONS] COMMAND [ARGS]...
+
+Commands:
+  validate   Validate rule files for syntax and semantic errors
+  convert    Convert rules between formats
+  dedup      Find and remove duplicate rules
+  info       Display rule metadata and ATT&CK mapping
+  report     Generate audit reports from cached results
+  stats      Show statistics for a rule collection
+
+Options:
+  --version  Show version
+  --help     Show help
+```
+
+### `secrulekit validate`
+
+```
+Options:
+  -f, --format [yara|sigma|suricata|snort|auto]
+                  Rule format (default: auto-detect)
+  -r, --recursive  Recurse into subdirectories
+  --strict         Treat warnings as errors
+  --report FILE    Write JSON/HTML report to FILE
+  --no-color       Disable colored output
+```
+
+### `secrulekit convert`
+
+```
+Options:
+  --to [splunk|elastic|yaral|qradar|suricata]
+                  Target format (required)
+  -o, --output FILE   Write output to file (default: stdout)
+  --batch          Convert all .yml files in directory
+```
+
+## Project Structure
+
+```
+secrulekit/
+├── secrulekit/
+│   ├── parsers/
+│   │   ├── yara_parser.py       # YARA rule parser
+│   │   ├── sigma_parser.py      # Sigma rule parser
+│   │   └── suricata_parser.py   # Suricata/Snort parser
+│   ├── validators/
+│   │   └── rule_validator.py    # Multi-format validator
+│   ├── converters/
+│   │   └── converter.py         # Format conversion engine
+│   ├── reporters/
+│   │   ├── json_reporter.py     # JSON output
+│   │   └── html_reporter.py     # HTML audit report
+│   ├── utils/
+│   │   └── helpers.py           # Fingerprinting, dedup, ATT&CK mapping
+│   └── cli.py                   # CLI entry point
+├── tests/
+├── rules/                       # Example rule sets
+│   ├── yara/
+│   └── sigma/
+└── docs/
+```
+
+## Contributing
+
+Contributions are welcome! Please read [CONTRIBUTING.md](CONTRIBUTING.md) before opening a pull request.
+
+## Security
+
+To report a security vulnerability in SecRuleKit itself (e.g., rule parsing that could cause denial-of-service or arbitrary code execution via crafted rule files), please follow the process in [SECURITY.md](SECURITY.md).
+
+**Security Maintainer:** [@lkop32788](https://github.com/lkop32788)
+
+## License
+
+MIT © 2026 Cherno.x — see [LICENSE](LICENSE).

secrulekit-1.2.0/pyproject.toml

@@ -0,0 +1,80 @@
+[build-system]
+requires = ["setuptools>=68", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "secrulekit"
+version = "1.2.0"
+description = "Parse, validate, convert, and manage YARA, Sigma, and Suricata security detection rules"
+readme = "README.md"
+license = { file = "LICENSE" }
+authors = [
+    { name = "Cherno.x", email = "long544844@gmail.com" }
+]
+maintainers = [
+    { name = "Cherno.x", email = "long544844@gmail.com" }
+]
+keywords = ["yara", "sigma", "suricata", "detection-rules", "security", "siem", "threat-hunting"]
+classifiers = [
+    "Development Status :: 5 - Production/Stable",
+    "Intended Audience :: Information Technology",
+    "Intended Audience :: System Administrators",
+    "Topic :: Security",
+    "License :: OSI Approved :: MIT License",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.8",
+    "Programming Language :: Python :: 3.9",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Operating System :: OS Independent",
+    "Environment :: Console",
+]
+requires-python = ">=3.8"
+dependencies = [
+    "click>=8.0",
+    "pyyaml>=6.0",
+    "rich>=13.0",
+    "typing-extensions>=4.0; python_version < '3.10'",
+]
+
+[project.optional-dependencies]
+dev = [
+    "pytest>=7.0",
+    "pytest-cov>=4.0",
+    "ruff>=0.1.0",
+    "mypy>=1.0",
+    "types-PyYAML",
+]
+
+[project.urls]
+Homepage = "https://github.com/lkop32788/SecRuleKit"
+Documentation = "https://github.com/lkop32788/SecRuleKit#readme"
+Repository = "https://github.com/lkop32788/SecRuleKit"
+Issues = "https://github.com/lkop32788/SecRuleKit/issues"
+Changelog = "https://github.com/lkop32788/SecRuleKit/blob/main/CHANGELOG.md"
+"Security Policy" = "https://github.com/lkop32788/SecRuleKit/blob/main/SECURITY.md"
+
+[project.scripts]
+secrulekit = "secrulekit.cli:main"
+
+[tool.setuptools.packages.find]
+where = ["."]
+include = ["secrulekit*"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+addopts = "-v --tb=short"
+
+[tool.ruff]
+line-length = 100
+target-version = "py38"
+
+[tool.ruff.lint]
+select = ["E", "F", "W", "I", "UP"]
+ignore = ["E501"]
+
+[tool.mypy]
+python_version = "3.8"
+strict = true
+ignore_missing_imports = true

secrulekit-1.2.0/secrulekit/__init__.py

@@ -0,0 +1,19 @@
+"""SecRuleKit — Security detection rule parser, validator, and converter."""
+
+from secrulekit.parsers.yara_parser import YaraParser
+from secrulekit.parsers.sigma_parser import SigmaParser
+from secrulekit.parsers.suricata_parser import SuricataParser
+from secrulekit.validators.rule_validator import RuleValidator, ValidationResult
+from secrulekit.converters.converter import RuleConverter
+
+__version__ = "1.2.0"
+__author__ = "Cherno.x"
+
+__all__ = [
+    "YaraParser",
+    "SigmaParser",
+    "SuricataParser",
+    "RuleValidator",
+    "ValidationResult",
+    "RuleConverter",
+]