[PATCH 1/4] ruleset-sources: Add details about rule sid and info URL

[Stefan Schantl <stefan.schantl@ipfire.org>]

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
---
 config/suricata/ruleset-sources | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/config/suricata/ruleset-sources b/config/suricata/ruleset-sources
index af65648af..5b9073d85 100644
--- a/config/suricata/ruleset-sources
+++ b/config/suricata/ruleset-sources
@@ -13,6 +13,8 @@ package IDS::Ruleset;
 # 	requires_subscription => "True/False" - If some kind of registration code is required in order to download the ruleset.
 # 	dl_url => The download URL to grab the ruleset.
 # 	dl_type => "archive/plain" - To specify, if the downloaded file is a packed archive or a plain text file.
+# 	sid_range => The sid range which the provider uses for it's rules, specified as an array. "[start sid, stop sid]"
+# 	sid_info_url => An URL which provides additional information about a rule based on it's sid.
 # },
 
 # Hash which contains the supported ruleset providers.
@@ -25,6 +27,8 @@ our %Providers = (
 		requires_subscription => "True",
 		dl_url => "https://www.snort.org/rules/snortrules-snapshot-29200.tar.gz?oinkcode=<subscription_code>",
 		dl_type => "archive",
+		sid_range => ["1", "1000000"],
+		sid_info_url => "https://www.snort.org/rule_docs/1-<sid>",
 	},
 
 	# Ruleset for registered sourcefire users with a valid subscription.
@@ -35,6 +39,8 @@ our %Providers = (
 		requires_subscription => "True",
 		dl_url => "https://www.snort.org/rules/snortrules-snapshot-29200.tar.gz?oinkcode=<subscription_code>",
 		dl_type => "archive",
+		sid_range => ["1", "1000000"],
+		sid_info_url => "https://www.snort.org/rule_docs/1-<sid>",
 	},
 
 	# Community rules from sourcefire.
@@ -45,6 +51,8 @@ our %Providers = (
 		requires_subscription => "False",
 		dl_url => "https://www.snort.org/downloads/community/community-rules.tar.gz",
 		dl_type => "archive",
+		sid_range => ["1", "1000000"],
+		sid_info_url => "https://www.snort.org/rule_docs/1-<sid>",
 	},
 
 	# Emerging threats community rules.
@@ -55,6 +63,8 @@ our %Providers = (
 		requires_subscription => "False",
 		dl_url => "https://rules.emergingthreats.net/open/suricata-5.0/emerging.rules.tar.gz",
 		dl_type => "archive",
+		sid_range => ["2000000", "2999999"],
+		sid_info_url => "https://threatintel.proofpoint.com/sid/<sid>",
 	},
 
 	# Emerging threats Pro rules.
@@ -65,6 +75,8 @@ our %Providers = (
 		requires_subscription => "True",
 		dl_url => "https://rules.emergingthreatspro.com/<subscription_code>/suricata-5.0/etpro.rules.tar.gz",
 		dl_type => "archive",
+		sid_range => ["2000000", "2999999"],
+		sid_info_url => "https://threatintel.proofpoint.com/sid/<sid>",
 	},
 
 	# Abuse.ch SSLBL Blacklist rules.
@@ -72,6 +84,7 @@ our %Providers = (
 		summary => "Abuse.ch SSLBL Blacklist Rules",
 		website => "https://sslbl.abuse.ch/",
 		tr_string => "sslbl blacklist rules",
+		sid_range => ["902200000", "902299999"],
 	},
 
 	# Etnetera Aggressive Blacklist.
@@ -82,6 +95,7 @@ our %Providers = (
 		requires_subscription => "False",
 		dl_url => "https://security.etnetera.cz/feeds/etn_aggressive.rules",
 		dl_type => "plain",
+		sid_range => ["500000", "599999"],
 	},
 
 	# OISF Traffic ID rules.
@@ -92,6 +106,7 @@ our %Providers = (
 		requires_subscription => "False",
 		dl_url => "https://openinfosecfoundation.org/rules/trafficid/trafficid.rules",
 		dl_type => "plain",
+		sid_range => ["300000000", "301000000"],
 	},
 
 	# Positive Technologies Attack Detection Team rules.
@@ -99,6 +114,7 @@ our %Providers = (
 		summary => "PT Attack Detection Team Rules",
 		website => "https://github.com/ptresearch/AttackDetection",
 		tr_string => "attack detection team rules",
+		sid_range => ["10000000", "11999999"],
 	},
 
 	# Secureworks Security rules.
@@ -130,6 +146,7 @@ our %Providers = (
 		requires_subscription => "False",
 		dl_url => "https://threatfox.abuse.ch/downloads/threatfox_suricata.rules",
 		dl_type => "plain",
+		sid_range => ["91000000", "91999999"],
 	},
 
 	# Travis B. Green hunting rules.
@@ -140,6 +157,7 @@ our %Providers = (
 		requires_subscription => "False",
 		dl_url => "https://raw.githubusercontent.com/travisbgreen/hunting-rules/master/hunting.rules",
 		dl_type => "plain",
+		sid_range => ["2610000", "2619999"],
 	},
 
 	ipfire_dbl => {
@@ -149,5 +167,6 @@ our %Providers = (
 		requires_subscription => "False",
 		dl_url => "https://dbl.ipfire.org/lists/suricata.tar.gz",
 		dl_type => "archive",
+		sid_range => ["406000000", "406999999"],
 	},
 );
-- 
2.47.3