Working with Signatures

A Signature represents a detection rule or pattern used to identify malicious activity, such as IDS/IPS rules, malware signatures, or other detection logic. The ThreatQ SDK enables you to create and manage signatures programmatically, allowing them to be tracked, enriched, and related to other threat intelligence objects within ThreatQ.

Create a New Signature

1. Before creating a signature, import the required SDK classes:
   from threatqsdk import Signature, Source

   Copy Code

2. Create a new signature by defining the required properties:

   Property	Description
   value	The signature content or rule definition
   type	The signature format or technology (for example, Snort)
   status	The workflow status assigned to the signature

   Example:

   signature_value = 'alert tcp $HOME_NET 666 -> 1.1.1.1 any (msg:"MALWARE-BACKDOOR SatansBackdoor.2.0.Beta"; flow:to_client,established; content:"Remote|3A| "; depth:11; nocase; content:"You are connected to me.|0D 0A|Remote|3A| Ready for commands"; distance:0; nocase; metadata:ruleset community; reference:url,www.megasecurity.org/trojans/s/satanzbackdoor/SBD2.0b.html; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=5260; classtype:trojan-activity; sid:118; rev:12;)'
   sig = Signature(tq)
   sig.set_value(signature_value)
   sig.set_type('Snort')
   sig.set_status('Review')
   

3. Upload the signature to ThreatQ and capture the newly assigned signature ID:
   sid = sig.upload(sources=Source('Test'))

   Copy Code

   The returned value contains the unique identifier assigned to the newly created signature.