In this clip,
we're going to cover the meaning of the term rule sets and rule sources and
discuss our options for managing them in Suricata Server.
Let's start with defining each term.
Suricata rule sets are pre‑written lists of Suricata rules
that take a predetermined action on traffic.
Rule sets can also be custom‑created rules you write,
which we'll cover in later courses.
Each combination of rules, either obtained externally or compiled by you,
is referred to as a rule set for the rest of this course.
The emerging threats rules are a good example of a rule set we
downloaded in the Getting Started course.
Suricata rule sources are locations of rule sets written for
Suricata and managed by external organizations.
Using the same emerging threats rule set as an example,
we obtained these from Proofpoint, downloading the open rule set.
Proofpoint was the rule source for the emerging threats rule set.
Let's walk through this with another visual to maintain
the distinction as we evaluate and use these terms
throughout the rest of this course.
Rule sets refer to a list of rules that Suricata uses to evaluate
each packet it receives and try to match the traffic before taking a
specific action defined in that rule.
We can create our own sets of rules or obtain them from rule sources.
Royal sources refer to the external entities we use to obtain
pre‑written rule sets and then download them to our Suricata
server for use in detecting packets.
Throughout this course, we'll learn to evaluate the available rule sources,
determine our desired external rule sets,
and manage our rule sets and sources in Suricata.
We have a few different options for managing rule sets.
The first is to use automated tools like suricata‑update to manage rule sources,
download rule sets, and activate them on our server.
We got a short introduction to this tool in the Getting Started course where
we listed available sources and selected one rule set.
Another method is to manually configure the files to detect the desired traffic.
This method on its own might give us the desired result,
but it's incredibly labor‑intensive.
The best option is to use a combination of manual and automated
configuration to make the most of pre‑written rule sets while adding
custom rules better suited to our environment and deactivating noisy
pre‑written rule sets that generate false positives.
In this course,
we're going to use the automated tool suricata‑update
to manage our rule sets and sources.
We'll evaluate open source rule sets and select
appropriate rule sets for our scenario.
We'll start covering open source rule sets in the next clip.