Scirius does only detects removed rules and not added over HTTP download

StamusNetworks / scirius

Scirius is a web application for Suricata ruleset management and threat hunting.

GNU General Public License v3.0

626 stars 150 forks source link

Closed Tomasuh closed 6 years ago

Tomasuh commented 6 years ago

I'm trying to track down the cause why Scirius only detects when I remove rules from my rule file.

When I first add the source and update, it downloads the complete signature rule file (over HTTP with all rules in a single file).

However when add new rules to the rule file, no change is detected by Scirius. Removed rules are detected

It works fine if I use the upload option instead.

Is this an issue you recognize?

pevma commented 6 years ago

After you add a new rule to the source file - does it appear if you update and push ?

Tomasuh commented 6 years ago

Seems like the issue was that the source were not enabled under "Rulesets -> My ruleset -> edit -> Edit categories". Started to work after that.

Took too long time for me to realize that =)

Anyways thanks for the fast response.