MeerkatSuricata/Snort formatter extension for VS Code FeaturesMeerkat provides the following features:
Signature checking with suricataSignature formatting
Hover informationVariable references/renaiming
Code completionCode snippletsPCAP TestingWarning: pcap visualization only works if additional third party extenssions are installed. Please install one of the available extenssions to be able to open pcap files in VS Code.
StructureMeerkat consists of three parts:
How to install itLinux/MacInstall cargo, if you have not done already:
You will be propted to accept the default configuration Install all dependencies for the project:
Package the extenssion:
The script will also install the meerkat language server for you At the end you should have a file named meerkat.vsix, which can be opened by VSCode WindowsMake sure you have rust installed! Install all dependencies for the project:
Package the extenssion:
The script will also install the meerkat language server for you At the end you should have a file named meerkat.vsix, which can be opened by VSCode UpdatingFollowing the installation steps and opening the .vsix file with VSCode should be enough to update the extenssion. Suricata signaturesDocsThe suricata documentation was used for a deeper understanding of the sturcture and function of suricata rules GrammarThe following grammar was used to implement a praser for the rules:
I want to contributeYou can easily contribute by reporting issues to the Git page of the project If you want to contribute by writing code, the rust docs for the project is a perfect location to start at, just run:
Installation troubleshootingUnexpected token '?'If you get the following error:
The issue is most probably the version of the Node that you're using. Linker 'cc' not foundIf you get the following error:
Try the following solution:
Vulnerabilities, while installing with npmThe issue is most probably related to the version of npm used. Try updating npm:
This command should tell you if you have an older version of npm and give you the line you need to run to update it |