Support Suricata transactional rule direction

server/modules/suricata/suricata_test.go

@@ -270,7 +270,7 @@ func TestValidate(t *testing.T) {
 		{
 			Name:        "Invalid Direction",
 			Input:       `alert http any any <-> any any (msg:"This rule has an invalid direction";)`,
-			ExpectedErr: "invalid direction, must be '<>' or '->', got <->",
+			ExpectedErr: "invalid direction, must be '<>', '->', or '=>', got <->",
 		},
 		{
 			Name:        "Unexpected Suffix",
@@ -432,6 +432,21 @@ func TestParse(t *testing.T) {
 	}
 }
 
+func TestParseTransactionalRules(t *testing.T) {
+	t.Parallel()
+
+	rule := `alert http any any => any any (msg:"transactional"; sid:1;)`
+	detections, err := ParseSuricataRules(context.Background(), rule, "ruleset")
+
+	assert.NoError(t, err)
+	if !assert.Len(t, detections, 1) {
+		return
+	}
+	assert.Equal(t, "1", detections[0].PublicID)
+	assert.Equal(t, "transactional", detections[0].Title)
+	assert.Equal(t, rule, detections[0].Content)
+}
+
 func TestExtractDetails(t *testing.T) {
 	t.Parallel()
 

server/modules/suricata/validate.go

@@ -81,7 +81,7 @@ func ParseSuricataRule(rule string) (*SuricataRule, error) {
 				buf.WriteRune(ch)
 			}
 		case stateSource:
-			if ch == '<' || ch == '-' {
+			if ch == '<' || ch == '-' || ch == '=' {
 				out.Source = strings.TrimSpace(buf.String())
 				buf.Reset()
 				buf.WriteRune(ch)
@@ -92,8 +92,8 @@ func ParseSuricataRule(rule string) (*SuricataRule, error) {
 		case stateDirection:
 			if ch == ' ' {
 				out.Direction = strings.TrimSpace(buf.String())
-				if out.Direction != "<>" && out.Direction != "->" {
-					return nil, fmt.Errorf("invalid direction, must be '<>' or '->', got %s", out.Direction)
+				if out.Direction != "<>" && out.Direction != "->" && out.Direction != "=>" {
+					return nil, fmt.Errorf("invalid direction, must be '<>', '->', or '=>', got %s", out.Direction)
 				}
 
 				buf.Reset()

server/modules/suricata/validate_test.go

@@ -38,10 +38,25 @@ func TestParseSuricata(t *testing.T) {
 				Options:     []*RuleOption{},
 			},
 		},
+		{
+			Name:  "Transactional Rule",
+			Input: `alert http any any => any any (msg:"transactional"; sid:1;)`,
+			Output: &SuricataRule{
+				Action:      "alert",
+				Protocol:    "http",
+				Source:      "any any",
+				Direction:   "=>",
+				Destination: "any any",
+				Options: []*RuleOption{
+					{Name: "msg", Value: util.Ptr(`"transactional"`)},
+					{Name: "sid", Value: util.Ptr("1")},
+				},
+			},
+		},
 		{
 			Name:  "Bad Direction",
 			Input: `a b source port <- destination port ()`,
-			Error: util.Ptr("invalid direction, must be '<>' or '->', got <-"),
+			Error: util.Ptr("invalid direction, must be '<>', '->', or '=>', got <-"),
 		},
 		{
 			Name:  "Unnecessary Suffix",