Categorizing rules related to usecases

Rules
,
1

I have few usecases for monitoring Suricata in wazuh.

  1. DDoS Attack
  2. Unauthorised Access
  3. Malware communication
  4. Data exfiltration
  5. SQL Injection
  6. Abnormal user privilege escalation
  7. Credential dumping
  8. Ransomware indicators
  9. Brute force attack
    Etc…

To create custom rules for this usecases, which all parameters i can take?
Which will be the common tag?

2

Since this question concerns wazuh, I suggest looking at Community | Wazuh and engaging there.

Suricata rules have “classifications” that might help – these are a rule’s classtype value. See 8.2. Meta Keywords — Suricata 8.0.0-dev documentation