---

<group name="suricata,ids,ot,">

  <!-- Базовое правило для всех Suricata-событий -->
  <rule id="100500" level="5">
    <decoded_as>json</decoded_as>
    <field name="event_type">alert</field>
    <description>Suricata: $(alert.signature)</description>
    <group>suricata,ids,</group>
  </rule>

  <!-- Высокий приоритет: атака на OT-сегмент -->
  <rule id="100501" level="10">
    <if_sid>100500</if_sid>
    <field name="alert.signature_id" type="pcre2">^100001[0-9]$</field>
    <description>OT Attack: $(alert.signature) - $(src_ip) → $(dest_ip):$(dest_port)</description>
    <mitre>
      <id>T1046</id>
      <id>T0846</id>
    </mitre>
    <group>ot_attack,unauthorized_access,</group>
  </rule>

  <!-- Конкретно про Kali в OT -->
  <rule id="100502" level="12">
    <if_sid>100500</if_sid>
    <field name="src_ip">10.0.20.10</field>
    <field name="alert.signature">Pentester</field>
    <description>CRITICAL: Pentester (Kali) attacking OT segment! From $(src_ip) to $(dest_ip):$(dest_port)</description>
    <mitre>
      <id>T1046</id>
    </mitre>
    <group>ot_attack,pentest_detected,</group>
  </rule>

  <!-- Fast.log формат (для plain-text Suricata-сообщений) -->
  <rule id="100510" level="7">
    <decoded_as>snort</decoded_as>
    <description>Suricata fast.log: $(id) from $(srcip) to $(dstip)</description>
    <group>suricata,ids,</group>
  </rule>

</group>