<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Implementing IDS Rules — API & Tool Reference

> Quick reference for tools, commands, and APIs used in implementing-ids-rules.

## Tools


### `suricata`

Network IDS/IPS engine

**Usage:**
```bash
suricata -c <config> -i <iface>
```

**Key Flags:**
  - `-T: test config`
  - `-S: rule file`
  - `-r: read PCAP`
  - `-l: log directory`
  - `--set: override config value`

---

### `suricata-update`

Rule management and update tool

**Usage:**
```bash
suricata-update
```

**Key Flags:**
  - `--suricata-conf: config path`
  - `enable-source: add rule source`
  - `list-sources: available sources`

---

### `suricatasc`

Suricata control socket client

**Usage:**
```bash
suricatasc -c <command>
```

**Key Flags:**
  - `reload-rules: hot reload`
  - `dump-counters: performance stats`
  - `iface-stat: interface stats`

---


## Integration Notes

- All tools should be run with least-privilege access appropriate to the task
- Log all tool invocations for audit trail
- Validate tool output before acting on results
- Cross-reference findings with multiple tools where possible

## See Also

- Parent skill: [Network Security](../../../SKILL.md)
- Technique SKILL.md: [../SKILL.md](../SKILL.md)
