Skip to content
The tool for updating your Suricata rules.
Branch: master
Clone or download
Latest commit 6d75a5d Jan 20, 2019
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
.github github/codeowners: add OISF/core-team Nov 3, 2017
bin bin/suricata-update: handle non-standard install prefixes. Feb 4, 2018
doc
suricata address code comments Apr 3, 2019
tests tests: test rule without rev gets rev 0 Feb 13, 2019
.gitignore testing: use tox for unit tests Dec 7, 2017
.travis.yml travis: call integration test Dec 21, 2018
CHANGELOG.md travis: call integration test Dec 21, 2018
LICENSE Initial import of Suricata-Update. Nov 2, 2017
MANIFEST.in manifest: add sample update.yaml Dec 5, 2017
Makefile bundle the index; for when it can't be downloaded Mar 22, 2018
README.rst
requirements.txt Initial import of Suricata-Update. Nov 2, 2017
setup.py
tox-integration.ini Add Python 3.7 to tox configurations Oct 4, 2018
tox.ini

README.rst

Suricata-Update

The tool for updating your Suricata rules.

Installation

pip install --upgrade suricata-update

Documentation

https://suricata-update.readthedocs.io/en/latest/

Issues

https://redmine.openinfosecfoundation.org/projects/suricata-update

Example Usage

suricata-update

The default invocation of suricata-update will perform the following:

  • Read the configuration, /etc/suricata/update.yaml, if it exists.
  • Read in the rule filter configuration files:
    • /etc/suricata/disable.conf
    • /etc/suricata/enable.conf
    • /etc/suricata/drop.conf
    • /etc/suricata/modify.conf
  • Download the best version of the Emerging Threats Open ruleset for the version of Suricata found.
  • Read in the rule files provided with the Suricata distribution from /etc/suricata/rules.
  • Apply disable, enable, drop and modify filters.
  • Resolve flowbits.
  • Write the rules to /var/lib/suricata/rules/suricata.rules.

If you are not yet ready to use /var/lib/suricata/rules then you may be interested in the --output and --no-merge command line options.

Suricata Configuration

The default Suricata configuration needs to be updated to find the rules in the new location.

Example suricata.yaml

default-rule-path: /var/lib/suricata/rules
rule-files:
  - suricata.rules

Optionally -S /var/lib/suricata/rules/suricata.rules could be provided on the Suricata command line.

Notes

This suricata-update tool is based around the idea /etc/suricata should not be used for active rule management, but instead as a location for more or less static configuration. Instead /var/lib/suricata is used for rule management and /etc/suricata/rules is used as a source for rule files provided by the Suricata distribution.

Files and Directories

/usr/share/suricata/rules
Used as a source of rules provided by the Suricata engine. If this directory does not exist, etc/suricata/rules will be used.
/etc/suricata/update.yaml
The default location for the suricata-update configuration file.
/etc/suricata/disable.conf
Default location for disable rule filters if not provided in the configuration file or command line.
/etc/suricata/enable.conf
Default location for enable rule filters if not provided in the configuration file or command line.
/etc/suricata/drop.conf
Default location for drop rule filters if not provided in the configuration file or command line.
/etc/suricata/modify.conf
Default location for modify rule filters if not provided in the configuration file or command line.
/var/lib/suricata/rules
The output directory for rules processed by the suricata-update tool. This directory is owned and managed by suricata-update and should not be touched by the user.
/var/lib/suricata/rules/suricata.rules

The default output filename for the rules processed by suricata-update.

This is a single file that contains all the rules from all input files and should be used by Suricata.

/var/lib/suricata/update/cache
Directory where downloaded rule files are cached here.
/var/lib/suricata/rules/cache/index.yaml
Cached copy of the rule source index.
/var/lib/suricata/update/sources
Configuration direction for sources enabled or added with enable-source or add-source.
You can’t perform that action at this time.