read_rules: Parse in a file of snort rules into a data frame

In hrbrmstr/porc: Tools to Work with 'Snort' Rules, Logs and Data

Description

The individual components of a Snort rule are parsed and put into a tidy data frame format. The rule options are also parsed and the resultant options columns is a data frame with option name and value. The value for options that do not have values is NA_character.

There is an id column which is just an index of the rule position in the file. An extra commented field exists to identify rules that are in the file but commented out. This makes it easy to filter on in-use rules.

The options column can be unnested with tidyr::unnest().

Usage

read_rules(path)

Arguments

path	path to snort rules file

Value

data frame

Examples

rules <- read_rules(
  system.file("extdata", "emerging-telnet.rules", package="porc")
)

hrbrmstr/porc documentation built on May 28, 2019, 5:43 a.m.