suricate规则更新脚本

前提

因为工作需要，需要从规则库中去更新最新的规则内容

思路
将新的规则文件去和老的规则文件做对比，将新的规则内容不在老的规则文件里面视为这个是需要更新添加的规则。

脚本

# -*- coding:utf-8 -*-

#更新所有规则的文件，将所有的规则合并后通过新的规则文件和老的规则文件对比，将新规则文件中不在老规则的文件内容提取出来。
import re 
import os



oldrule = [] #老的规则
newrule =[] #新的规则
uprules =[]
oldlj = [] #老的路径
newlj = [] #新的路径


def oldrules(oldrules):
    with open(oldrules,'r',encoding='utf-8')as fa:
        for old in fa.readlines():
            if "alert" in old:
                oldrule.append(old)
                
def newrules(newrules):
    with open(newrules,'r',encoding='utf-8')as fb:
        for new in fb.readlines():
            if "alert" in new:
                newrule.append(new)
                
def walfFile(file,name):
    for root,dirs,files in os.walk(file):
        for f in files:
            allfile = os.path.join(root,f)
            name.append(allfile)
            
            

oldru = "/home/oldrules" #老的规则文件路径
newru = "/home/updaterules" #新的规则文件路径
walfFile(oldru,oldlj)
walfFile(newru,newlj)
for oldi in oldlj:
    oldrules(oldi)
    
for newi in newlj:
    newrules(newi)

sum = 0
for i in newrule:
    if i not in oldrule:
        print(i)
        sum += 1
        with open("20210514.rules",'a',encoding='utf-8')as ff:
            ff.write(i)

print("总共更新了{0}规则".format(sum))

效果