## https://sploitus.com/exploit?id=7312085A-30C8-587D-A73B-B1CA3F2D4A49
# PoC2Rule Agent
Automatically convert PoC (Proof of Concept) files into detection rules (Snort/Suricata). ## Inputs
Three input formats are supported:
| Format | Example |
|------|------|
| Python PoC file | `python main.py -p poc.py` |
| Plaintext HTTP request | `python main.py -r request.txt` |
| PoC file URL | `python main.py -u https://example.com/poc.py` |
## Outputs
- **PCAP** – Attack traffic packets
- **Detection IR** – Intermediate detection rules (JSON)
- **Snort Rule** – Snort rules (support for Suricata later)
- **Test report** – Results of rule testing
## Quick Start
```bash
# 1. Configure
cp config.yaml.template config.yaml
# Edit config.yaml and fill in the LLM API key, etc.
# 2. Install dependencies
pip install -r requirements.txt
# 3. Run
python main.py -p examples/poc_sqli.py
python main.py -r examples/request.txt
python main.py -u https://example.com/poc.py
# 4. View outputs
ls workspace/output/
```
## Project Architecture
```
Inputs (POC/HTTP/URL)
│
▼
Workflow (Python control, LangGraph)
│
┌─────────┼─────────┐
▼ ▼ ▼
Planner Inference Plugin
│ │ │
└─────────┼─────────┘
▼
Tool (Python execution)
```
- **Workflow** – Python controls the entire process; LLM does not intervene in the process.
- **Planner** – Local agents responsible for individual node strategies (e.g., PCAP generation).
- **Inference** – Single LLM inference; no cycling or scheduling of Tools.
- **Plugin** – Expands rule formats without changing the Workflow.
- **Tool** – Pure Python execution, no prompts required.
## Directory Structure
```
├── main.py # Program entry point
├── workflow.py # LangGraph workflow
├── config.yaml.template # Configuration template
├── requirements.txt
├── app/ # Application base (State, Context, Logger)
├── llm/ # LLM encapsulation (Client, Inference, Planner, PromptBuilder)
├── workflow_nodes/ # 11 workflow nodes
├── tools/ # 7 execution tools
├── inference/ # Inference skills (SKILL + Knowledge + Examples)
├── plugins/ # Rule format plugins
├── schemas/ # Data models
├── planners/ # Planner strategies
├── workspace/ # Working directory
└── logs/ # Logs
```
## Extensions
### Adding new rule formats
Create a new directory under `plugins/` and implement the `PluginBase` interface. **No changes to the Workflow are required.**
### Adding new models
Modify `config.yaml` to use OpenAI, DeepSeek, Qwen, or vLLM as the LLM provider.
### Adding new packet capture methods
Add new tools under `tools/`, and register them in the corresponding Planners.
## Dependencies
- Python >= 3.10
- LangGraph / LangChain
- Scapy
- Docker (optional, for sandboxing PoC)
- Snort (optional, for rule validation and testing)