In this clip,
we'll cover the suricata‑update process and how we can
use it to manage rule sources and sets.
We'll start with the suricata‑update process flow.
When you run the basic command, suricata‑update,
it initiates a seven‑step process to obtain configuration files,
update rules, and apply configuration changes.
The first step in this process is obtaining the update.yaml file if it exists.
This file contains the locations of the configuration
files that suricata‑update uses to enable,
disable, ignore, and modify rules.
It also contains a list of remote rule source URLs and
directories containing local rules.
Once it knows the location of each configuration file,
Suricata will start by obtaining four specific files.
These are called enable.conf, disable.conf, modify.conf, and drop.conf.
We'll use each of these files later in the module to
manage our rules and change rule behavior.
Once it finishes reading in these rule filter configuration files,
suricata‑update obtains rule sets from remote rule sources.
By default, the emerging threats rule, ETOpen, is obtained.
In the next demo,
we'll view the available sources and add additional remote
rule sources to obtain new rule sets.
After obtaining rule sets from external sources,
suricata‑update will evaluate local directories,
like /etc/suricata/rules, and search for additional local rule files.
At this point,
suricata‑update completes the process of reading in the configuration
and obtaining rules from external and local sources.
It then moves to the second phase where it applies the
configuration changes and rules.
In this phase,
suricata‑update applies the filters it read in from the configuration files,
enable, disable, modify, and drop.
This adjusts the actual rules written in the last step.
After applying filters, suricata‑update resolves flowbits.
This concept is a little beyond the scope of this course.
But for your understanding,
flowbits are used to allow Suricata to check multiple
conditions before generating an alert.
Flowbits can be used to check for a few conditions like the
direction of traffic or established TCP connections.
Flowbits can also be used to match conditions across multiple packets and only
generate an alert if the conditions match on all packets.
They are very useful in rule writing, but beyond the scope of this course.
Once suricata‑update finishes resolving the flowbits,
it moves to the last step where it writes the rules to
suricata.rules for use on our Suricata server.
As you can see, this is a powerful tool for rule management,
allowing us to automate a series of steps that would be
very consuming as a manual process.
Adjusting the configuration files allows us to quickly
adjust the behavior of suricata‑update.
Adjusting the configuration files enables us to quickly
adjust the behavior of suricata‑update,
allowing us to adjust the rule sources for remote rules,
manage the rule sets, enable or disable rules on our server,
and modify rule behavior to make changes or drop traffic.
Now that we understand how suricata‑update obtains and manages rules,
we're ready to start the process by adjusting the rule
sources and obtaining some new rule sets.
In the upcoming demos, we'll evaluate new rule sources,
discuss how to enable or disable them,
and then obtain new rules from our selected sources.