SigInt-Hombre, generates derived Suricata detection rules from live URLhaus threat indicators at runtime and deploy them to the Security Onion platform for high-coverage real-time network monitoring. https://github.com/malvuln/sigint-hombre What it does: Pulls the public URLhaus feed in real time (not mirrored or redistributed) Skips: Comments, empty lines, malformed URLs, and feed self-references Normalizes and extracts: Protocol, host, URI path, and port Deduplicates hosts into consistent rule keys Generates original, derived Suricata alerts for 3 layers: HTTP → host + URI path, any port if none is specified (max coverage) TLS → HTTPS detection via SNI (tls.sni) only DNS → domain lookup visibility via dns.query Deduplication logic: HTTP → (host, path) HTTPS/TLS → host DNS → host Writes all alerts into a single combined rule file Restarts Suricata rules (so-suricata-restart --force) Malvuln