Skip to content

Add packet-filter-rule MISP object definition and README entry#501

Merged
adulau merged 1 commit intomainfrom
codex/propose-packet-filter-object-template
Apr 8, 2026
Merged

Add packet-filter-rule MISP object definition and README entry#501
adulau merged 1 commit intomainfrom
codex/propose-packet-filter-object-template

Conversation

@adulau
Copy link
Copy Markdown
Member

@adulau adulau commented Apr 8, 2026

Motivation

  • Provide a standardized MISP object to represent packet-filter, firewall, and ACL rules across network security platforms to improve sharing and correlation of rule metadata.
  • Capture common rule fields such as action, source/destination selectors, ports, protocol, product/vendor, and the original rule text for analysis and enrichment.

Description

  • Add objects/packet-filter-rule/definition.json defining the packet-filter-rule object with attributes including action, comment, destination, destination-port, direction, enabled, interface, logging, product, protocol, raw-rule, reference, rule-format, rule-id, rule-name, sequence-number, source, source-port, and vendor.
  • Include sensible defaults (sane_default) and UI priorities (ui-priority) for many attributes and mark correlation-disabled where appropriate.
  • Set object metadata: name = packet-filter-rule, meta-category = network, requiredOneOf = ["raw-rule", "rule-id", "rule-name"], uuid = 2f06d31e-cc48-4e50-bd3a-9f97c0c71e6a, and version = 1.
  • Update README.md to add the new object entry linking to the definition in objects/packet-filter-rule/definition.json.

Testing

  • No automated tests were run for this change.

Codex Task

@adulau adulau merged commit 995c51f into main Apr 8, 2026
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant