In this clip, we'll discuss how to enable,
disable, and adjust rules using suricata‑update's configuration files.
We have a few different techniques available to accomplish this that
give us a lot of flexibility in our rule management.
Let's look at how we can enable and disable rules.
To enable or disable rules with suricata‑update,
we modify the enable.conf and disable.conf files.
We have three options for making this adjustment.
We can use the signature ID, regular expressions,
and the group name to make this change.
Using the signature ID allows us to enable or disable single rules.
This is valuable when we notice that one particular rule
generates a large amount of false positives or it's just
not useful in our environment.
Regular expressions allow us to match multiple rules
based on our expression statement.
Another way of matching multiple rules is to enable or disable by group
using the file name containing that category of rules.
This method allows you to enable or disable all of one type of rules,
like all ICMP rules or all scanning rules.
Adjusting the configuration files also allows us to modify
rule behavior using the same techniques.
We can use modify.conf to change the way a rule operates
or adjust the rule's configuration.
You could use this to change all dropped rules to an alert.
You could also change the behavior of a rule by signature ID and
adjust the values of its matching conditions.
If your goal is to configure rules to drop,
you can also just use drop.conf and match rules by signature ID,
regular expression, or group.
Now that we know what techniques we will use to adjust our rules,
we're ready for the next two demos where we'll use these
four files on our Suricata server.