signatures.yml

# TracePcap Custom Signatures
# ============================
# Add your own detection rules here. Each matched rule appends its `name` to the
# conversation's custom rules, making it visible in the Custom Rules filter and
# security alerts.
#
# Rules are reloaded on every file analysis - no restart required after editing.
#
# Rule format:
#   signatures:
#     - name: rule_name_shown_in_ui   # use underscores, no spaces
#       description: Human-readable description
#       severity: low                  # low | medium | high | critical
#       match:
#         ip: "203.0.113.42"           # all match fields are optional
#                                      # a rule fires when ALL specified fields match
#
# Match fields:
#   ip       - exact match against source OR destination IP          (e.g. "203.0.113.42")
#   cidr     - CIDR range match against source OR destination IP     (e.g. "10.0.0.0/8")
#   srcPort  - exact source port match                               (e.g. 67)
#   dstPort  - exact destination port match                          (e.g. 4444)
#   ja3      - exact match against JA3S fingerprint hash             (e.g. "82f0d8a75fa483d1cfe4b7085b784d7e")
#   hostname - exact or wildcard SNI hostname                        (e.g. "*.evil.com")
#              wildcard matches any subdomain at any depth
#   app      - case-insensitive nDPI application name                (e.g. "Telegram", "TOR", "DNS")
#   protocol - case-insensitive transport protocol                   (e.g. "TCP", "UDP", "ICMP")
#
# Payload inspection (top-level, alongside match):
#   payload_contains - list of {ascii: "..."} or {hex: "..."} byte-string patterns
#   payload_regex    - list of {pattern: "..."} regular expressions (applied to decoded payload)
#                      optional: case_insensitive: true per entry
#   match_all: true  - require ALL payload_contains / payload_regex entries to match (default: OR)
#
# Severity colors in the UI:
#   critical -> red   | high -> orange   | medium -> amber   | low -> purple
#
# See signatures.sample.yml in the repository root for a full set of examples.
# ----------------------------------------------------------------------------

signatures: