fedcode-next: Code pipeline and models to continuously collect scripts and vulnerability scanner rules to detect if the vulnerability is "expressed"

These are commonly published for important vulns. This can include yara rules, rules for IDS like Suricata, ClamAV entries, OpenVAS and nessus rules and related, like with MISP

Yara rules:

Suricata rules:

Sigma rules:

https://github.com/SigmaHQ/sigma

ClamAV:

Snort Rule:

https://github.com/thereisnotime/Snort-Rules

We have two options for storing rules:

Pre-parsing: Parse the rule to extract specific fields before saving like (metadata , ....)
Raw Storage: Store the raw text without validation.

Rule parsing :

YARA
Sigma
Standard YAML files that are easy to parse.
Suricata (No metadata)
- https://github.com/m-chrome/py-suricataparser
ClamAV (No metadata)
- The signature base can be parsed using simple Python.

I think we can start with an initial model like this:

class DetectionRule(models.Model):
    RULE_TYPES = [
        ("yara", "YARA"),
        ("sigma", "Sigma Detection Rule"),
        ("clamav", "ClamAV Signature"),
        ("suricata", "Suricata Rule")
    ]

    rule_type = models.CharField(max_length=100, choices=RULE_TYPES, blank=True)

    source_url = models.URLField(
        null=True,
        blank=True,
    )

    rule_metadata = models.JSONField(
        null=True,
        blank=True,
    )
    rule_text = models.TextField()

    advisory = models.ForeignKey(
        AdvisoryV2,
        related_name="detection_rules",
        on_delete=models.SET_NULL,
        null=True,
        blank=True,
    )

At this stage we have:

Add a pipeline to collect Sigma rules #2028 that is ready to merge
after that Add support for ClamV entries collection #2051 and Add support for YARA data collection #2056 are good to go after fixing migrations

We should have an API and/or a minimal UI to view that data.

DetectionRule can have multiple advisories

see:
https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_filewrite_in_sharepoint_layouts_dir.yml

I think I should update the model to be like this

class DetectionRule(models.Model):
    """
    A Detection Rule is code used to identify malicious activity or security threats.
    """

    rule_type = models.CharField(
        max_length=50,
        choices=DetectionRuleTypes.choices,
        help_text="The type of the detection rule content (e.g., YARA, Sigma).",
    )

    source_url = models.URLField(
        max_length=1024, help_text="URL to the original source or reference for this rule."
    )

    rule_metadata = models.JSONField(
        null=True,
        blank=True,
        help_text="Additional structured data such as tags, or author information.",
    )

    rule_text = models.TextField(help_text="The content of the detection signature.")

    related_advisories = models.ManyToManyField(
        AdvisoryV2,
        related_name="detection_rules",
        help_text="Advisories associated with this DetectionRule.",
    )

I'm closing the following PRs:

I will be replacing them with a single pipeline that runs on GitHub Actions:

Add support to collect rules using GitHub Actions aboutcode-data/detection-rules-collector#1

At this stage, we have:

Add support to collect rules using GitHub Actions aboutcode-data/detection-rules-collector#1, which is ready to merge.

After that,

Add support for importing detection rules #2267 and Add API and UI support for vulnerability rules #2208 will be good to go once the we resolve migration conflict.

As a follow we need to consider some dependencies update:

This is now complete.

This will continuously collect, using a Github Action, scripts and vulnerability scanner rules to detect if the vulnerability is "expressed". The rules are stored and made available at https://github.com/aboutcode-data/detection-rules-collector

We are collecting rules using this PR:

Add support to collect rules using GitHub Actions aboutcode-data/detection-rules-collector#1

YARA rules data sources:

Suricata:

Sigma:

ClamAV:

https://database.clamav.net/main.cvd?api-version=1 ( "main.ldb", "main.hdb", "main.ndb") files

To complete the integration into VulnerableCode and enable the UI and API for rule management and searching, we should merge these PRs:

Navigation Menu

Repository navigation

fedcode-next: Code pipeline and models to continuously collect scripts and vulnerability scanner rules to detect if the vulnerability is "expressed" #1723

We have two options for storing rules:

Rule parsing :

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

fedcode-next: Code pipeline and models to continuously collect scripts and vulnerability scanner rules to detect if the vulnerability is "expressed" #1723

Description

Activity

ziadhany commented on Nov 11, 2025

ziadhany commented on Dec 2, 2025

We have two options for storing rules:

Rule parsing :

pombredanne commented on Dec 18, 2025

pombredanne commented on Mar 6, 2026

ziadhany commented on Mar 25, 2026

ziadhany commented on Apr 14, 2026

pombredanne commented on May 14, 2026

ziadhany commented on May 14, 2026

ziadhany commented on May 14, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions