SigInt-Hombre v1 / dynamic Suricata detection rules from real-time threat feeds

[malvuln <malvuln13 () gmail com>]

SigInt-Hombre, generates derived Suricata detection rules from live
URLhaus threat indicators at runtime and deploy them to the Security
Onion platform for high-coverage real-time network monitoring.

https://github.com/malvuln/sigint-hombre

What it does:
Pulls the public URLhaus feed in real time (not mirrored or redistributed)

Skips:
Comments, empty lines, malformed URLs, and feed self-references
Normalizes and extracts:

Protocol, host, URI path, and port
Deduplicates hosts into consistent rule keys

Generates original, derived Suricata alerts for 3 layers:
HTTP → host + URI path, any port if none is specified (max coverage)
TLS → HTTPS detection via SNI (tls.sni) only
DNS → domain lookup visibility via dns.query

Deduplication logic:
HTTP → (host, path)
HTTPS/TLS → host
DNS → host

Writes all alerts into a single combined rule file
Restarts Suricata rules (so-suricata-restart --force)

Malvuln
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/