Ruler: A Webapp for Testing, Writing, and Sharing Suricata Rules

At Merlon, we have started taking engineering network detection more seriously, and found detection rules hard to evaluate and share easily. What we wanted was a simple application that allows us to test Suricata/Snort detection rules against a set of PCAPs, and to quickly let colleagues vet the results.

To solve this detection evaluation and sharing problem, we have made Ruler: a super simple and lightweight webapp for running Suricata/Snort style detection rules against a user-provided set of PCAPs. It also stores these PCAPs for a limited time, allowing users to share their session with colleagues, ensuring that they are looking at the same test data, and detection.

All the code is hosted at the brand new Merlon organization on codeberg (https://codeberg.org/merlon/ruler), where we're super open to new issues and pull requests. We've also done our best to make the code as easy to deploy as possible so have a look!

I'm super curious what you think, and what you would like to see changed.