One of the first things to get comfortable with is to know how to get help.
Often, terminal‑based utilities such as suricata‑update,
provide built‑in help systems. To view help, we'll use the ‑h option.
As you can see, there are quite a few options available for
how to interact with suricata‑update.
What we're going to focus on is the basics, and those are
the commands listed under other commands.
Fortunately, these commands also have built‑in help.
You can provide the ‑h argument after any of these
commands to get specific help.
Let's look at list‑sources.
If we run the command suricata‑update list‑sources ‑h, you
can see specific help for that command.
This certainly helps getting to know suricata‑update much easier.
Going back to the list‑sources command, if we run that, we will
get a listing of all available sources from the intel index, which
is maintained by the Suricata team.
This will provide you with a list of common rule sources,
some of which are free, and others that require a subscription.
You can generally identify those that need a subscription by their
license type, it will be listed as commercial.
You may also want to take note of any sources that are for non‑commercial use.
Okay,
so there are a lot of sources available to you, but what's enabled by
default? To answer that question, we can use the command
list‑enabled‑sources, and as promised, et/open is already enabled.
Now a common next step when getting into rules and sources is to want to enable
a new source, so let's take the abuse.ch JA3 fingerprints as an example. We can
use the list‑sources command to list those sources again, and then we'll want to
take note of the name of this source.
In this case, it's the third entry from the bottom.
The name is sslbl/ja3‑fingerprints. Enable‑source will use
the name value to then enable that source.
So let's run the command,
suricata‑update enable‑source, and then the name of the source we want
to enable, sslbl/ja3‑fingerprints. If successful,
you will see an enabled message with the name of the
source at the bottom of the output.
Now we can run list‑enabled‑sources to simply confirm that this
source is now enabled. We've updated our sources, the next step
is to typically download those rules. To do this, you can simply
run suricata‑update.
This will do many things.
You will see information about where it is fetching
rules from based on your sources.
It will let you know if any rules have been modified, dropped, or disabled.
It also shows that a single rule file was written to
var/lib/suricata/rules/suricata.rules along with how many rules are
in the file. And finally, you'll see information about how many rules
were enabled, added, removed, and modified since your last update. As
we noted earlier in the course,
we still have one more step to go and that's to get those rules into the engine.
Since Suricata is already running,
we can use the Suricata SC utility to perform a live rule reload.
This is in contrast to having to stop and restart the engine. To
accomplish this live rule reload, run the command suricatasc ‑c
reload‑rules, and you'll be all set. If you are interested in
learning more about Suricata SC,
you can find detailed information in Suricata's online
documentation. Upon command completion,
you'll get a status message indicating whether it was successful or not.
In this case, it looks like our rule reload went well.
This is just the beginning for managing rules and there's plenty to consider,
for example,
when would you want to use a ruleset like the JA3 fingerprints from abuse.ch.
As with many things in technology, it really depends, and
you'll learn more about how to determine what sources are right
for you, as we go through the course.