search

StamusNetworks / scirius

Scirius is a web application for Suricata ruleset management and threat hunting.
GNU General Public License v3.0
614 stars 150 forks source link

Sync suricata srules\thresholds\suppressions between multiple Scirius install #225

Open n00bsteam opened 3 years ago

n00bsteam commented 3 years ago

Hi!

What I did: first configured sources on all IDS Scirius CE, updated all rulse, then went to suricata-> ruleset actions-> build & push, after copying two files from IDS-1 / etc / suricata / rules / two files: threshold .config and scirius.rules to another IDS, and the same action "go to suricata-> ruleset actions-> build & push". Unfortunately, this did not lead to any changes on IDS-2, IDS-3, etc., the files are back to the original state of the rules. If I am doing something wrong, please explain the method how to implement it.

Thx community for u hard and great work!

regit commented 3 years ago

Do you have one Scirius CE by probe ? What we do in our commercial product (Scirius Security Platform) is to have on Scirius per multiple probes. If going commercial is out of your scope, you could just then build&push the ruleset to a specific directory and then copy the result to the remote probes.

n00bsteam commented 3 years ago

No, i have 3 Scirius CE installs.

n00bsteam commented 3 years ago

If i copy after build&push threshold .config and scirius.rules from SciriusCE_1 to SciriusCE_2, SciriusCE_3 and etc, overwrite and build&push, threshold .config and scirius.rules at target SciriusCE_1 to SciriusCE_2, SciriusCE_3 and etc, the files are back to the original state of the rules.

pevma commented 3 years ago

Maybe make the changes you wan ton CE1 and then propagate - it will overwrite but it is the intention to have those changes done right ?

n00bsteam commented 3 years ago

No, files, what i move from SciriusCE_1 overwrited by actual settings of SciriusCE_2 after build&push.

n00bsteam commented 3 years ago

The last thing I did and visually it worked, exported all the rules_ * tables from sqlite3 SciriusCE_1 and import them (drop exist befor) to sqlite3 SciriusCE_2\3\4 etc, but looks like its not good method.