For this demonstration,
we're going to modify a noalert rule to enable it to generate alerts.
From our sample pcap, you can see a number of alerts that have been generated.
If you look at the third alert,
this indicates that a PE file was downloaded from an
HTTP request with minimal headers.
For this to work, we actually have to have two alerts,
one to detect the minimal HTTP header request and another to
determine that the HTTP response was a PE file.
We can now grep on the SID, which is 2016538.
You'll see that it does, in fact, use the flowbit keyword,
checking if variable min.gethttp is set.
To find the rule that sets this flowbit,
let's grep our rule file for the keyword :set,min.gethttp.
There's our rule, sid:2016537.
Let's change this so that it generates an alert.
To do that,
we'll create the file modify.conf under etc/suricata and then add the
following line. We'll match the rule by SID, then match the from value of
flowbits:noalert;. The to value will be an empty string.
We just want to remove this keyword altogether.
Now we can run suricata‑update again, and you'll
notice that there was a modified rule.
If we grep our newly modified rule file,
you'll see that it no longer has the noalert
keyword. Since we changed our rules,
we need to restart Suricata. Then we can replay our
pcap and observe this new alert.
And there it is.
While this may not be the most practical situation, it does highlight
how you can begin to research rules and modify them to meet the needs
of your security and network monitoring.