In this demo,
we'll cover how to enable and disable different rule
sources using suricata‑update.
We have three goals to accomplish for Globomantics in this demo.
We need to obtain rule sets from each of the sources
we identified in the previous demo.
We need to use suricata‑update to activate each source and
automatically download the rule sets.
And once we obtain each set,
we need to run Suricata to ensure that the new rules are active on our server.
Let's head over to our server and get started.
We'll start by enabling the trafficid rule source. To enable a rule source,
we issue the command sudo suricata‑update enable‑source followed by the
vendor and the rule list name. For the trafficid rule set,
that's this name right here, oisf/trafficid. When you look at these messages,
this last one shows us that the source oisf/trafficid was
enabled. For our next source, we decided on the threat
hunting rules by Travis Green.
That name is right here, tgreen/hunting. Let's go
ahead and enable those as well.
And we get a message saying those were enabled as well.
Once we've added these rule sources,
we enable them by issuing the command suricata‑update.
Now that we know the suricata‑update process,
we can see the different steps that suricata‑update goes through when we run
this command. So we can see the different rules that are disabled as a result
of reading the configuration files. We can see it going out and trying to
obtain the latest copy of the emerging threats rules, our trafficid rules,
and our threat‑hunting rules.
Mine says it last downloaded less than 15 minutes ago because I tested
this before I recorded it. But yours should have a fresh copy that it
downloads from each of those rule sources.
Once it finishes that, it loads the distribution rule files. It ignores the
emerging deleted rules and loads the total of 30,023 rules, disables 14, and
enabled 147 rules for flowbit dependencies.
Once it finishes all those,
it writes the rules to usr/local/var/lib/suricata/rules/suricata.rules. And
we can see it loaded 30,000 rules and enabled 22,558 of them. And we've
added a total of 1,652 new rules and removed 249.
Once it was done,
it ran a test with suricata ‑T to make sure that the configuration didn't fail.
To satisfy our goals, we can see that each of our selected rule sources was
loaded. It downloaded the latest copy of the rule set.
It loaded the rules that come with our Suricata distribution. And we
now have a total of 30,000 rules on the server,
and 22,558 of them are active.
I'll save the tests of these new rules for the last two demos of this
module where we enable, disable, and adjust rule behavior.