Home › Docs ›Detection › Pattern Database

Pattern Database

Every CVE, generic signature, upload and header rule, scanner tool and Suricata SID the edge stack can detect — with provenance, scores and attack lessons.

Detection catalogue

Every pattern, one catalogue

This page is generated from the same patterns/patterns.json that the PyQt dashboard reads. It merges the Lua CVE patterns, Layer 1 and Layer 2 generic signatures, header and upload analysis, the Attack Simulation presets and all 70 Suricata SIDs into one searchable inventory.

Select any row to open its side panel: trigger, score path, source files, WSTG / OWASP / ATT&CK mapping, the simulation preset that proves it, and a plain-language lesson. Deep-link a pattern with ?pattern=<id>.

133 Patterns Stable catalogue IDs

15 CVEs Plugin + core vulnerabilities

70 Suricata SIDs Network-layer evidence

11 Rule sources Lua, Suricata, presets, upload

Generated 2026-10-23 from tools/generate_pattern_catalog.py. Run it after changing a rule source; --check fails when this page would be stale.

Browse patterns

Filter first, then read the side panel. The panel is a drawer on narrow screens.

133 of 133 patterns

Pattern Type · category · severity

Now live

Registry & pattern picker

This page is generated and read-only, but the dashboard now layers a mutable registry on top of it. patterns/registry.json, owned by dashboard/core/pattern_registry.py, records only deviations from the generated catalogue — so a stable ID, its provenance and its export shape remain the contract, while enable state and edits live separately and never touch patterns.json.

OverridesPer-ID field changes on a generated pattern (enabled included). Re-enabling prunes the override, so the file keeps only real deviations.

Custom recordsFull patterns authored in the Pattern Database page, filled out to the catalogue shape and merged alongside the generated ones.

One decision, everywhereA pattern switched off is dropped from the Attack Simulation battery and the Segmentation Validation preset list via active_presets().

Clean resetA missing or corrupt registry.json loads as empty — every pattern enabled, nothing custom. Deleting the file resets the overlay.

The Pattern Database page is the editor: a per-row checkbox toggles a pattern on or off, and per-pattern and bulk actions add, edit, duplicate, remove, revert and export. Disabling here is authoritative — "off in the database" means off in every run that builds its attack set from the catalogue.

Pattern picker

Attack Simulation and Segmentation Validation select patterns through a shared picker: a button opens a searchable, scrollable checkbox popup capped at half the window height, instead of an unbounded dropdown. Registry-disabled patterns never appear in it.

Checked set = the batch. On Attack Simulation the checked patterns are the Multi-run and PDF-report battery; on Segmentation Validation they drive the per-window attacks and the "Attack from all" round-robin spread across windows.
Highlighted row = single run. Highlighting one row (without changing the checks) targets just that pattern for a single curl / browser run.
GDPR signature restore is highlight-only. It is marked, not checkable, so it is never swept into a batch — highlight it to fire it deliberately.
Uncheck-all is safe. With nothing checked, Segmentation Validation falls back to the built-in window_plan so a report still produces per-window attacks.

The reverse-proxy and Suricata exporters are expected to read the same registry next, so the one enable/disable decision reaches the live edge too. See patterns/README.md for the overlay's schema.

Coverage & provenance

Counts are by catalogue source rather than by file. A single pattern can carry evidence from several layers — for example a CVE pattern, its Suricata SID and the Attack Simulation preset that proves the route.

24 Automation scoring pattern_rules.lua

18 Header analysis pattern_rules.lua

14 Lua CVE pattern init.lua

80 Lua Layer 1 pattern_rules.lua

49 Lua Layer 2 pattern_rules.lua

13 Vulnerability rules vulnerability_rules.lua

2 Request method pattern_rules.lua

33 Simulation preset dashboard/core/patterns.py

1 Session policy session_rules.lua / GDPR

70 Suricata rule ids/suricata_rules/local.rules

33 Upload analysis upload_rules.lua

Source files

ids/reverse_proxy_enhanced/lua/pattern_rules.lua
ids/reverse_proxy_enhanced/lua/init.lua
ids/reverse_proxy_enhanced/lua/vulnerability_rules.lua
ids/reverse_proxy_enhanced/lua/upload_rules.lua
ids/suricata_rules/local.rules
dashboard/core/patterns.py
dashboard/core/learning.py

The generated file is checked in at patterns/patterns.json. If a rule source changes, regenerate it; the stale check compares everything except the generation date.