Help me ! Writing rules in XP language.

[kiborgNIk]

Hello!
Again, a person who wants to understand this rather interesting system writes!
Interested in the possibility of writing rules in the XP language? Does it exist and how can this be done?
I didn't find this information in the documentation.....
We really need your help!

[asdek]

Hello @kiborgNIk, for building your rules subset you could use this repo and VS code plugin:
https://github.com/Security-Experts-Community/vscode-xp

Also you can read the documentation:
https://vscode-xp.readthedocs.io/ru/latest/
https://vscode-xp.readthedocs.io/en/latest/

Just for testing and easy start you can use open XP rules:
https://github.com/Security-Experts-Community/open-xp-rules

For building it as SOLDR module you need to use this script:
https://github.com/vxcontrol/soldr-modules/blob/master/tools/gen_correlator_config.py

Command to run it:
https://github.com/vxcontrol/soldr-modules/blob/74831c4c97ef9b198391ebc63c633ff339155c30/tools/README.md?plain=1#L3

In the end of building procedure you get zip archive with module content and you should import it via UI:
https://doc.vxcontrol.ru/ru-RU/3357143947/portal
https://doc.vxcontrol.com/en-US/3357143947/portal

[kiborgNIk]

Thanks! I will try.