Match DSL

The match DSL is a declarative mini-language for config and CLI (ip=, asn=, country=, path=, path regex=, ua=, header.X=, method=, protocol=, reputation=, time=, combinable with AND/OR/ NOT and parentheses). It is parsed into RuleMatch at runtime. Same syntax for the CLI --match and rules test.

The parser is a recursive-descent parser in sentry-core/src/rules/dsl.rs (14 tests).

Supported operators

Field	Operator	Example
IP	ip=	ip=10.0.0.0/8, ip=192.168.1.1
ASN	asn=	asn=14061
Country	country=	country=RU
Path	path=	path=/admin/* (glob), path regex=^/api/.*$
User-Agent	ua=	ua contains sqlmap, ua=python-requests
Header	header.X=	header.X-Forwarded-For contains 1.2.3.4
Method	method=	method=POST
Protocol	protocol=	protocol=Http
Reputation	reputation=	reputation=Tor
Status	status=	status=404
Time	time=	time outside(09:00-18:00 America/Sao_Paulo)

String operators

• equals (default when only =)
• contains
• startswith
• regex=

Logical combinators

• AND (commutative)
• OR
• NOT
• Parentheses ( ) for grouping

Examples

[[rules.custom]]
name = "allow internal monitoring"
priority = 1
match = 'ip=10.0.0.0/8'
action = "allow"

[[rules.custom]]
name = "challenge datacenter ASN outside business hours"
priority = 20
match = 'asn=14061 AND time outside(09:00-18:00 America/Sao_Paulo)'
action = "challenge"

[[rules.custom]]
name = "block admin from RU"
priority = 10
match = 'country=RU AND path=/admin/*'
action = "block"

CLI usage

sentry rules add --name "block admin from RU" \
    --match 'country=RU AND path=/admin/*' --action block --priority 10

sentry rules test --path /admin --ua "sqlmap/1.0" --ip 1.2.3.4

sentry rules test simulates which rules would match a hypothetical event, useful to validate rules before promoting them to enforce.