rulefmt

Overview ¶

rulefmt formats and checks IDS rule files (Snort, Suricata).

Usage:

rulefmt [flags] [path ...]

The flags are:

-d, -diff
	Do not print reformatted sources to stdout.
	If a file's formatting is different from rulefmt's, print diffs
	to standard output.
-l, -list
	Do not print reformatted sources to stdout.
	If a file's formatting is different from rulefmt's, print its name
	to standard output.
-w, -write
	Do not print reformatted sources to stdout.
	If a file's formatting is different from rulefmt's, overwrite it
	with rulefmt's version.
-c, -check
	Check if files are formatted and parseable. If any file is unformatted
	or has parse errors, exit with status 1.
-t, -lint
	Run rule linting checks (e.g. missing SID, expensive PCRE, should be HTTP).