In this demo, we're going to add a custom rule source to our Suricata server.
We're going to use the suricata‑update command to quickly
add a new source and then rerun suricata‑update to obtain
rules from our custom source.
If you're ready to get started,
let's head over to our Suricata server and add that custom source.
We can use suricata‑update to add a custom source to our server and
obtain new rule sets. For this demo, I added a few example rules to
a GitHub project so you can use it.
These rules will be used in the next module to attempt
to detect attacks on our IRC server.
I'll just copy this URL for the next step. To enable the source,
we just add the source by URL by entering the command sudo
suricata‑update add‑source followed by a name for this, in my case I'll
use the name example, and then the URL for the source.
Great.
Our new source is added to our server. Now we can download the new
rules by issuing the command suricata‑update.
Perfect.
Let's check our output to see the results.
Here we do see that although our custom source failed the checksum,
it did still download the new rule set. And then when it wrote the rules,
it added three more as we expected. Adding custom sources is valuable
when you find a source that contains rules to help you detect threats,
but the source is not available within suricata‑update by default. If
you want to remove a custom source,
you issue the command suricata‑update remove‑source
followed by the name of the custom source.
In our case,
that would be example again. You don't need the URL to remove a source.