<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Validating Network Detection Rules

## Suricata

### Commands

| Command | Description |
|---|---|
| `suricata -r <pcap> -S <rules> -l <outdir>` | Run rules against PCAP |
| `suricata -T -S <rules> -c <config>` | Validate rule syntax |
| `suricata-update` | Update ET ruleset |
| `suricata-update list-sources` | List available rule sources |

### EVE JSON Alert Fields

| Field | Description |
|---|---|
| `alert.signature_id` | Rule SID |
| `alert.signature` | Rule message |
| `alert.severity` | Alert severity 1–4 |
| `alert.category` | Alert category |
| `src_ip` / `dest_ip` | Source and destination IPs |
| `proto` | Protocol (TCP/UDP/ICMP) |

## Zeek

### Commands

| Command | Description |
|---|---|
| `zeek -r <pcap> local` | Process PCAP with default scripts |
| `zeek -r <pcap> script.zeek` | Process with custom script |
| `zeek-cut field1 field2 < log.log` | Extract specific fields |

### Key Log Files

| Log | Content |
|---|---|
| `conn.log` | Connection summaries |
| `dns.log` | DNS queries and responses |
| `http.log` | HTTP requests |
| `ssl.log` | TLS handshakes and JA3 hashes |
| `notice.log` | Detection notices and alerts |
| `weird.log` | Protocol anomalies |

## Agent Script

```bash
# Test Suricata rules
node agent.js test-suricata --rules custom.rules --pcap c2-traffic.pcap --expected-sids 2030001

# FP check
node agent.js test-suricata --rules custom.rules --pcap benign.pcap --expect-clean

# Test with Zeek
node agent.js test-zeek --pcap dns-tunnel.pcap --script detect-tunnel.zeek

# Validate syntax
node agent.js validate-syntax --rules custom.rules

# Batch test
node agent.js batch-test --techniques T1071.001,T1071.004,T1048.003 --pcap-dir samples/
```
