FEATURE: Support Custom Suricata Rulesets via URL and local file

Security-Onion-Solutions / securityonion

Security Onion is a free and open platform for threat hunting, enterprise security monitoring, and log management. It includes our own interfaces for alerting, dashboards, hunting, PCAP, detections, and case management. It also includes other tools such as osquery, CyberChef, Elasticsearch, Logstash, Kibana, Suricata, and Zeek.

https://securityonion.net

3.32k stars 514 forks source link

FEATURE: Support Custom Suricata Rulesets via URL and local file #13195

Closed defensivedepth closed 5 months ago

defensivedepth commented 5 months ago

Add a new configuration option for Suricata engine, similar to what we already have for YARA and Sigma, something like this:

{"community":true,"ruleset":"snort-community","license":"GPL","url":"https://www.snort.org/downloads/community/snort3-community-rules.tar.gz"}
{"community":true,"ruleset":"dd-rules","license":"Elastic-2.0","file":"/nsm/detections/suricata/local_rules/dd-rules.rules"}

Salt changes will be needed as well.

defensivedepth commented 5 months ago

Validation Status: Completed