suricata rules mgmt

daily rules update

either send USR2 signal or suricatasc ==> rule-reload

assuming alpine linux

vi /etc/periodic/hourly/suricata-update

#!/bin/sh

suricata-update >/dev/null \
        && kill -USR2 `cat /var/run/suricata.pid 2>/dev/null` \
        || echo error: could not update suricata rules from cron job

chmod +x /etc/periodic/hourly/suricata-update

disable false-positives

first identify the matching gid and signature id from log-server (SIEM) (alert.gid and alert.signature_id fields)

gid=1
sigid=906200068
grep $sigid /var/lib/suricata/rules/suricata.rules

then disable that specific signature with some explanation for the record

cd /etc/suricata/
cp -i /usr/lib/suricata/python/suricata/update/configs/disable.conf .
vi /etc/suricata/disable.conf

# SSLBL: Malicious JA3 SSL-Client Fingerprint detected (CoinMiner)
# this is localhost talking to elasticsearch
1:906200068

# SURICATA STREAM TIMEWAIT ACK with wrong seq
# we do not necessarily need that much detail unless we check layer1
1:2210042

# SURICATA STREAM Packet with invalid timestamp
# maybe hardware checksum offload
1:2210044

and apply

suricata-update
systemctl restart suricata
systemctl status suricata

resources

https://docs.suricata.io/en/latest/rule-management/suricata-update.html

https://nsrc.org/workshops/2015/pacnog17-ws/attachments/ex-suricata-rules.htm

https://nsrc.org/workshops/2015/pacnog17-ws/raw-attachment/wiki/Track2Agenda/ex-suricata-config-test.htm ==> blacksun

suricata rules mgmt

daily rules update

disable false-positives

resources

emerging-user_agents.rules

disable

signals