In this demo,
we'll use the same rule management techniques in two different files.
We'll use the modify.conf to change rule behavior and adjust rule parameters,
and we'll add rules to the drop.conf to cause these
rules to drop matching traffic.
Let's head over to our Suricata server and get started.
Our first step is to use one of the techniques to modify rule behavior.
So let's open up modify.conf.
And again, we have a few helpful examples of how to format things here.
Back when we were evaluating the emerging threats rule set,
we found a rule for ProFTPD, and we enabled it in the last demo.
But that rule was set for port 21,
and our ProFTPD server is running on port 2121.
So let's use modify.conf to change the port for that particular signature,
which was 2011994.
And we'll change 21 to 2121.
And we're ready for the next step where we'll leverage drop.conf.
So let's go ahead and go to modify that file.
And for this one, we're going to use a regular expression,
and we're going to leverage our trafficid rules,
and we're going to set every rule that matches Netflix to drop.
Now when we run sudo suricata‑update, let's see what happens.
Now we see that our rules changed.
Again, we have enabled 19, modified 1, and dropped 14 rules.
We'll be testing some of these in the next module,
so let's go ahead and check the results by examining our rules file.
All right, here's our rules file.
We'll first go check the results of modify.conf to see if that worked.
We'll just search for the signature itself, and there's our SID.
Let's go check the beginning of this rule,
and we can see that this rule is now written perfectly for our environment.
It's enabled, and it's set to HOME_NET 2121.
Let's check one of the Netflix rules.
And here's one of our Netflix rules, which is now set to drop.
So throughout the last two demos, we used the enable,
disable, modify,
and drop files to make changes across multiple rules
using three different methods, by signature ID,
by regular expression, and by group.
Now that we've made these changes,
you're ready for the next module where we'll use a packet capture
replay technique to evaluate the effects of different changes we
made to each of these rule sets,
as well as enabling and disabling the rule sources themselves.