Writing rules

Rules evaluate typed scan observations as they arrive. Use them to identify exposed services, suspicious infrastructure, software, and protocol-specific behaviour.

A rule being evaluated into classified results

Rule anatomy

Each source contains one YARA rule. Conditions read fields from the infrawatch module.

import "infrawatch"

rule Exposed_Redis_Without_Authentication {
  meta:
    description = "Redis accepted a probe without requiring authentication"

  condition:
    defined infrawatch.scan.redis.authentication_required and
    infrawatch.scan.port == 6379 and
    not infrawatch.scan.redis.authentication_required
}

The rule editor validates and formats source before a rule can be enabled.

Detection metadata

Keep detection logic in the source. Set its meaning separately:

Setting	Purpose
Classification	`benign`, `suspicious`, or `malicious`
Categories	Slash-delimited paths such as `malware/c2`
Tags	The labels applied when the rule matches
Input	Scan results or certificate events

See the intelligence taxonomy for the canonical category paths and classification model.

Write reliable conditions

Prefer typed protocol fields over banner text.
Check that an optional field is defined before using it.
Combine independent signals to reduce false positives.
Put reusable text or byte patterns in the strings section.
Explain the detection intent in meta.description.

Copy working examples

Start with compiled Redis, MQTT, and HTTP detections.

Browse protocol fields

Find the exact path and type emitted by each scanner.

Overview

Data products

External Surface Intelligence

Fingerprinting

Rules

Projects

Data Dictionary

Scanning policy

Rule anatomy

Detection metadata

Write reliable conditions

Copy working examples

Browse protocol fields

​Rule anatomy

​Detection metadata

​Write reliable conditions

Copy working examples

Browse protocol fields

Rule anatomy

Detection metadata

Write reliable conditions