Welcome to the next module for this course where we will discuss how
to leverage suricata‑update to manage rule sources,
rule sets, and how to enable or disable rules.
Let's go to the overview and see what we'll cover in this module.
We'll begin with an overview of suricata‑update and
how we can use it in this course,
including the process it uses to obtain new rules and apply them.
Once we have an understanding of how suricata‑update manages rules,
we'll move on to a series of demos on how to view and update our rule sources,
select the appropriate rule sources, and add a custom rule source.
After managing rule sets and sources,
we'll use suricata‑update to manage specific rules and groups of rules.
We'll use three different techniques to enable and disable rules,
as well as modify their behavior.
Now that we know what we'll cover, let's take a quick look at suricata‑update.
Suricata‑update is a rule management tool for Suricata,
created by the Open Information Security Foundation, OISF. We used
this tool in the Suricata: Getting Started course to obtain and
apply the Emerging Threats rule set.
Its basic function is to configure rule sources and rule sets,
but we also used it as a tool to automatically manage rules
by signature ID, regular expression, or rule category using
simple configuration changes.
Suricata‑update makes rule management a simple process and
enables us to quickly adjust our configuration,
obtain large rule sets, and manage our rule sources.
If you're ready to get started leveraging this tool,
we'll begin with the overview of the process to
manage the sources in the next clip.