diff --git a/pkgs/development/python-modules/idstools/default.nix b/pkgs/development/python-modules/idstools/default.nix
new file mode 100644
index 000000000000..54528caddb65
--- /dev/null
+++ b/pkgs/development/python-modules/idstools/default.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pytestCheckHook,
+  python-dateutil,
+  pythonOlder,
+  setuptools,
+  sphinx,
+  sphinxcontrib-programoutput,
+}:
+
+buildPythonPackage rec {
+  pname = "idstools";
+  version = "0.6.5";
+  pyproject = true;
+
+  disabled = pythonOlder "3.11";
+
+  src = fetchFromGitHub {
+    owner = "jasonish";
+    repo = "py-idstools";
+    tag = version;
+    hash = "sha256-sDar3piE9elMKQ6sg+gUw95Rr/RJOSCfV0VFiBURNg4=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    python-dateutil
+    sphinx
+    sphinxcontrib-programoutput
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "idstools" ];
+
+  meta = {
+    description = "Module to work with Snort and Suricata Rule and Event";
+    homepage = "https://github.com/jasonish/py-idstools";
+    changelog = "https://github.com/jasonish/py-idstools/releases/tag/${version}";
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index fbb6c7877c80..7feb8a738cf3 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6223,6 +6223,8 @@ self: super: with self; {
 
   idna-ssl = callPackage ../development/python-modules/idna-ssl { };
 
+  idstools = callPackage ../development/python-modules/idstools { };
+
   ifaddr = callPackage ../development/python-modules/ifaddr { };
 
   ifconfig-parser = callPackage ../development/python-modules/ifconfig-parser { };