Sharing rules
في هذه الصفحة
Rules are plain JSON files with their own tests, so they travel well. Share them with your team, and with the community through the public Signal rule library.
Sharing inside your team
Keep your rules in a version-controlled folder, one file per topic.
Run
signal rules -check -rules <dir>before every change is accepted.Give the folder to every run:
-rules \\server\signal$\rules. Pack it first if it names tools.Signal Console's Rules page lists each rule file the hosts loaded, with its rules and the hosts that ran them. On a host whose run was not given the file, an imported rule is "not evaluated: rule file not given to the run".
The community rule library
Signal Rules is the public rule library on GitHub, where analysts share rules. Every rule in it is reviewed before it is merged, and every rule is free to use, under the MIT License, with any edition of Signal.
git clone https://github.com/intrusion-academy/Signal-Rules.git
signal rules -check -rules .\Signal-Rules\rules
signal live -all -rules .\Signal-Rules\rulesContributing a rule
-
Write and test it
Every key, the three texts (
detail,impact,focus), at least one match and one look-alike test. -
Run the check
signal rules -check -rules <your folder>must pass. -
Tune it
Run it on clean hosts; add each false positive as a look-alike test.
-
Open a pull request
Say what it detects, why it is suspicious in itself, which hosts it was tuned on, and its false positives.
The review checklist
Check | Why |
|---|---|
The check passes, with a look-alike test | The fidelity contract. |
File names matched whole; paths anchored at the drive | Not fooled by a chosen name or path. |
A raw log rule names its provider and event ID | One ID means different things from different providers. |
The severity follows the criteria; a state is medium at most | Severities mean the same in every rule. |
The texts say what happened, why it matters and what to do next | An analyst can act on the signal alone. |
The rule is defensive: it detects, it never explains how to attack | The library is for defenders. |
Tags are only what the evidence shows happened | A capability is not its use. |