From PLAN.md step 6. Spec: docs/spec.md. Phase 1.
⟂ Parallel-safe — touches files no other concurrent step touches.
Files: src/flabel/suricata.py, tests/test_suricata.py, tests/fixtures/rules/synthetic.rules
Changes: Invoke with -S <snapshot>/rules.rules so only snapshot rules load and no ambient system ruleset leaks in; --runmode single for a deterministic alert set; JA3/JA4 fingerprinting enabled by --set. Parse eve.json alert records into Detection, resolving each SID's originating source from the snapshot manifest. Drop detections from identify-class sources before they can become labels, counting them.
Test that proves it: a synthetic rule matching benign.pcap produces exactly one parsed Detection with correct sid/rev/classtype/tuple/timestamp. A synthetic ja4.hash rule matching a TLS fixture also produces a detection — proving the JA4 labelling capability independent of whether content exists (US-14). An identify-source rule that fires yields zero detections and increments identify_alerts_suppressed (US-16). Two runs produce the same alert set.
Depends on: 2 (and step 4's snapshot writer for a real snapshot; a hand-built snapshot directory suffices to keep them parallel). Parallel with: 3, 4, 5.
From
PLAN.mdstep 6. Spec:docs/spec.md. Phase 1.Files:
src/flabel/suricata.py,tests/test_suricata.py,tests/fixtures/rules/synthetic.rulesChanges: Invoke with
-S <snapshot>/rules.rulesso only snapshot rules load and no ambient system ruleset leaks in;--runmode singlefor a deterministic alert set; JA3/JA4 fingerprinting enabled by--set. Parseeve.jsonalert records intoDetection, resolving each SID's originating source from the snapshot manifest. Drop detections fromidentify-class sources before they can become labels, counting them.Test that proves it: a synthetic rule matching
benign.pcapproduces exactly one parsedDetectionwith correct sid/rev/classtype/tuple/timestamp. A syntheticja4.hashrule matching a TLS fixture also produces a detection — proving the JA4 labelling capability independent of whether content exists (US-14). Anidentify-source rule that fires yields zero detections and incrementsidentify_alerts_suppressed(US-16). Two runs produce the same alert set.Depends on: 2 (and step 4's snapshot writer for a real snapshot; a hand-built snapshot directory suffices to keep them parallel). Parallel with: 3, 4, 5.