Default Passive Scan Rules

Noir's default rules look for hard-coded secrets: API keys, tokens, private keys and connection strings. With -P, Noir downloads the rules on the first run, checks them for updates, and can update them for you.

Rule Locations

OS	Path
macOS	~/.config/noir/passive_rules/
Linux	~/.config/noir/passive_rules/
Windows	%APPDATA%\noir\passive_rules\

If NOIR_HOME is set, rules live in $NOIR_HOME/passive_rules/ instead. noir rules path prints the directory in use.

The official Docker image ships a rules snapshot at /opt/noir/passive_rules. When the user directory is empty, Noir uses that snapshot and skips the clone and the update check, so -P works in the container without git or network.

Automatic Initialization and Update Checks

With -P enabled, Noir:

1. Initializes rules on first run by cloning noir-passive-rules to ~/.config/noir/passive_rules/
2. Checks for updates by comparing local and remote repositories. The remote is fetched at most once a day; scans in between compare against the last fetch. --passive-scan-auto-update and noir rules update always fetch.
3. Notifies you when rules are outdated
4. Updates them, if auto-update is on

Repository: https://github.com/owasp-noir/noir-passive-rules

CLI Options

• --passive-scan-auto-update: Auto-update rules on startup
• --passive-scan-no-update-check: Skip update checks (useful for air-gapped environments). This also skips first-run rule initialization, so on a machine that has never downloaded the rules, place them in ~/.config/noir/passive_rules/ manually (or pass --passive-scan-path) first.

Both options are also configurable via ~/.config/noir/config.yaml (passive_scan_auto_update, passive_scan_no_update_check).

You can also manage the rules outside a scan: noir rules update pulls the latest rules, noir rules list shows the installed rule files, and noir rules path prints the rules directory.

Example Usage

# Default behavior - check for updates and notify if behind
noir scan /app -P

# Auto-update rules on startup
noir scan /app -P --passive-scan-auto-update

# Skip update checks completely
noir scan /app -P --passive-scan-no-update-check

Sample Output

First run (auto-initialization):

⚬ Passive scanner enabled.
⚬ Initializing passive rules directory...
✔ Passive rules initialized successfully.
  ├── Using default passive rules (/home/user/.config/noir/passive_rules).
  └── Loaded 40 valid passive scan rules.

When updates are available:

⚬ Passive scanner enabled.
▲ Passive rules are 3 commits behind the latest version.
  ├── Run 'git pull' in /home/user/.config/noir/passive_rules to update
  ├── Or use 'git clone https://github.com/owasp-noir/noir-passive-rules.git /home/user/.config/noir/passive_rules' to get the latest rules
  ├── Or run 'noir scan . -P --passive-scan-auto-update' to auto-update on startup

With auto-update enabled:

⚬ Passive scanner enabled.
⚬ Updating passive rules (3 commits behind)...
✔ Passive rules updated successfully.

Customizing Rules

Add your own .yml or .yaml rule files to the same directory. The next passive scan loads them along with the default rules.