Skip to content
NETALERT Documentation NETALERT Docs User Documentation
Version 1.3

Documentation

Rule Feeds

Rule Feeds

Introduction

In addition to its statically defined rules, NETALERT supports integrating third-party rules into its detection engine.

This module enables NETALERT to be interconnected with Threat Intelligence (TI) solutions for automatic rule downloads, ensuring up-to-date threat detection.

Supported Rule Types and Methods:

  • Snort Compatible List (txt, one per line, files with *.rules extension)

  • Snort Compatible List (tar.gz, list of files)

  • Classic Threat Intelligence IP List (IP list, one per line)

  • CQ Threat Intelligence

  • Mining Nodes (IP, one per line)

  • TOR Exit Nodes (IP, one per line)

  • DDNS (IP/Server, one per line)

  • BANNED DNS (IP/Server, one per line)

  • BANNED SMTP (IP/Server, one per line)

  • IOC IP (IP, one per line)

  • IOC Domain (Domain, one per line)

  • IOC JA3 (JA3 hash, one per line)

  • IOC JA4 (JA4 fingerprint, one per line)

  • Sigma Rules (tar.gz/zip archive of .yml rules)

When these integrations are enabled, NETALERT downloads and updates rule lists daily from the configured feeds:

  • CYBERQUEST Threat Intelligence and Classic Threat Intelligence IP lists – Retrieved data is added to the IOC (Indicators of Compromise) IP list.
  • Snort-compatible rules – Downloads the necessary rule sets and integrates them into the detection engine.
  • Sigma rules – Downloads the archive of Sigma .yml rules and loads it into the Sigma Rules list.

Snort compatible rule example:

alert ip $EXTERNAL_NET any -> $HOME_NET any ( msg:"OS-WINDOWS Microsoft WIndows IGMP dos attack"; fragbits:M+; ip_proto:2; metadata:ruleset community; reference:bugtraq,514; reference:cve,1999-0918; reference:url,technet.microsoft.com/en-us/security/bulletin/MS99-034; classtype:attempted-dos; sid:272; rev:16; )
alert icmp $EXTERNAL_NET any -> $HOME_NET any ( msg:"PROTOCOL-ICMP ath"; itype:8; content:"+++ath",fast_pattern,nocase; metadata:ruleset community; reference:cve,1999-1228; classtype:attempted-dos; sid:274; rev:13; )

NETALERT currently supports the alert ip type rules. More detection types will be added in future releases.

When configured to download a .tar.gz rule archive, NETALERT automatically extracts the resulting archive, concatenates the extracted rules into a single ruleset, and adds it to the detection engine.

Access Rule Feeds

To access Rule Feeds, navigate to Administration > Security & Threat Intelligence > Rule Feeds, and the page will open.

Alt Image

Adding a new detection rule

To add a new detection rule, click the Add Rule Feed button. In this example, you want to add a detection rule to automatically download and integrate a list of compromised IPs from an external source into the NETALERT detection engine.

  • NETALERT will regularly fetch the compromised IPs list from the specified URL.
  • The downloaded Snort-compatible rules will be added to the detection engine.
  • Alerts will be triggered for network traffic matching the compromised IP addresses in the list.

Alt Image

  • Name – A descriptive name for the detection rule.

  • URL – The source URL from which the rule data will be downloaded.

  • Type – Select the appropriate rule type from the dropdown list.

  • API Key – Shown only for the CQ Threat Intelligence type; the key used to authenticate to the CYBERQUEST Threat Intelligence feed.

Click Save to create the rule, or Close to discard it.

After creating a new Detection Rule, the following management actions become available:

  • Edit – Lets you modify the rule’s details, such as its name, URL, or type.
  • Active switch – Enables or disables the rule without deleting it.
    • Active: The rule is in use, and NETALERT regularly fetches and applies updates.
    • Inactive: The rule remains stored but is not processed or updated.
  • Delete – Permanently removes the detection rule from the system. You are asked to confirm first.

Rule Feeds in NETALERT can be added from various sources to expand threat detection coverage. These rule types include:

Rule TypeDescription
Snort Compatible List (txt, one per line)A plain text file containing Snort rules, with each rule written on a separate line. Used for defining packet inspection rules based on network traffic patterns.
Snort Compatible List (tar.gz, list of files)A compressed archive containing multiple Snort rule files. The system extracts and merges them into a single ruleset for the detection engine.
Classic Threat Intelligence IP List (IP list, one per line)A simple list of IP addresses, each on a separate line.
Used for blocking or monitoring known malicious IPs.
CQ Threat IntelligenceIntegrates CYBERQUEST Threat Intelligence, a proprietary threat intelligence feed. Provides real-time updates on suspicious IPs, domains, and indicators of compromise (IOCs).
Mining Nodes (IP, one per line)A list of known cryptocurrency mining nodes, formatted as one IP per line. Helps in detecting unauthorized mining activities within a network.
TOR Exit Nodes (IP, one per line)A list of exit nodes from the TOR (The Onion Router) network. Used to identify traffic originating from anonymized sources.
DDNS (IP/Server, one per line)A list of Dynamic DNS (DDNS) hosts or IP addresses. Helps in monitoring domains frequently changing their IPs, which may indicate malicious intent.
BANNED DNS (IP/Server, one per line)Contains a list of banned DNS servers or IPs that should not be accessed within the network. Helps prevent connections to known malicious or unauthorized DNS servers.
BANNED SMTP (IP/Server, one per line)Lists banned SMTP servers or IPs used for email communication. Useful for blocking known spam servers, preventing phishing attempts, or restricting outbound email traffic.
IOC IP (IP, one per line)Includes a list of IPs flagged as Indicators of Compromise (IOC). Used to detect and block traffic from known malicious sources, including botnets, malware servers, or attackers.
IOC Domain (Domain, one per line)Contains domains associated with threats or compromise. Helps detect and prevent access to phishing sites, malware distribution domains, or command-and-control (C2) servers.
IOC JA3 (JA3 hash, one per line)A list of JA3 TLS client fingerprints tied to known malicious tooling, added to the IOC JA3 list.
IOC JA4 (JA4 fingerprint, one per line)A list of JA4 TLS client fingerprints, added to the IOC JA4 list.
Sigma Rules (tar.gz/zip archive of .yml rules)An archive of Sigma detection rules in YAML format, loaded into the Sigma Rules list.