pulling suricata ruleset

[y0d4a]

Hi, i am new in this product, right now just testing it as PoC. I install master and node, and now want to see packages from TAP (from node).

Problem is that servers are behind proxy and i suppose that is the reason why i cannot download it. "Error downloading! Can not complete the download..."

log file:

2020/08/27 09:00:20.526 [E] [rulesetSource.go:581]  Error downloading file! Get https://openinfosecfoundation.org/rules/trafficid/trafficid.rules: dial tcp: i/o timeout
2020/08/27 09:00:20.526 [E] [rulesetSource.go:99]  Error downloading file from RulesetSource-> Get https://openinfosecfoundation.org/rules/trafficid/trafficid.rules: dial tcp: i/o timeout

Is there settings for proxy or i am doing something wrong.. ?

tnx.

[72nomada]

Hi, @y0d4a you are right, Proxy settings are not set yet. we have to do it. Will try to have it done soon...

[y0d4a]

al right, is there some workaround to put those rules? manually to add?

tnx.

[72nomada]

https://owlh.atlassian.net/browse/OWLH-450

[72nomada]

about rules,

you can download rules from our repo in a single file or create your own rules files

wget https://repo.owlh.net/localrules/owlh-etopen.rules

after the file is in your master, create a custom ruleset, set the path of your owlh-etopen.rules and you should be done. your ruleset should be useful now.

Hope it helps... until we do our job... sorry

[y0d4a]

done, tnx.

and fyi: WARNING: The certificate of ‘repo.owlh.net’ is not trusted. WARNING: The certificate of ‘repo.owlh.net’ hasn't got a known issuer. WARNING: The certificate of ‘repo.owlh.net’ was signed using an insecure algorithm. WARNING: The certificate of ‘repo.owlh.net’ has expired.

[72nomada]

ups... you are right. we will update it...

[y0d4a]

and thank you for your quick response and this seems like, great product!