메뉴
Reuse Snort rules that already fired in past experiments. ALWAYS consult this skill at the start of every cycle BEFORE writing a new rule. Validated rules are known-good detection patterns persisted per attack_id under data/validated_rules/.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Generate Snort 3.9.7.0 IDS rules from a natural-language operator intent. Use whenever you need to write a new rule, refine an existing one, or recover from a syntax error.
How to produce an evasion variant of a previously successful attack. Use this when request_variant=True on the attacker request.
How to execute the selected attack container on the attacker host and interpret the result.
How to map an operator intent to one of the attacks discovered on the attacker host. Use this before calling execute_attack.
Rule-generation refinement playbook for MQTT Brute Force — credential brute force against MQTT brokers on TCP port 1883 using dictionary attacks. Load when the operator intent maps to attack_id mqtt-bruteforce.
Rule-generation refinement playbook for MQTT LWT Abuse — abuse of MQTT Last Will and Testament to publish malicious payloads under the broker's trusted identity. Load when the operator intent maps to attack_id mqtt-lwt-abuse.
| name | validated-rules-library |
| description | Reuse Snort rules that already fired in past experiments. ALWAYS consult this skill at the start of every cycle BEFORE writing a new rule. Validated rules are known-good detection patterns persisted per attack_id under data/validated_rules/. |
| metadata | {"load_order":"first"} |
The testbed maintains a persistent library of Snort rules that already produced an IDS alert
(fired=True) in earlier experiments. These rules are known-good for their attack family. Before
spending budget on a brand-new rule, ALWAYS try a validated one first.
validate_rule_syntax for the first time in the cycle.This applies to ALL attacks. There are no exceptions.
attack_id you will execute this cycle. For base cycles, infer it from the
operator intent (e.g. intent "quero gerar regras xrce-dds-udp-dos" ⇒ attack_id
xrce-dds-udp-dos). For variant cycles, reuse the previous iteration's attack_id.get_validated_rules(attack_id). The tool returns a list of canonicalized rules
(sid:0;, rev:1;). The most recent additions are at the END of the list.validate_rule_syntax → assign_sid → deploy_rule → trigger_attacker →
check_alert_fired exactly like a freshly generated rule.snort-rule-generation skill and the matching per-attack refinement playbook.record_iteration(fired=True, rule=...) automatically appends it to
the validated library. You do not need to call any extra tool.<action> <proto> any any -> any any — no IPs, no ports.sid: to 0 and rev: to 1 before validating. assign_sid will replace the
zero with a fresh unique SID.