Just installed Suricata (6.0.10) from apt in Debian 12. Might upgrade to a newer Suricata soon, but for now i run with what apt provides.
For instance, the HOME_NET variable in suricata.yaml can be an array, like this
HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
Thats implicitly OR between those nets.
What if i wanted an AND? Possibly even with a negated value, is that possible?
For instance something like this
EXTERNAL_NET: "!$HOME_NET"
YAHOO: "1.2.3.0/24"
EXT_NOT_YAHOO: "[$EXTERNAL_NET _and_ !$YAHOO]"
Does that make sense? If possible, how do i write that?
12.1. Suricata.yaml — Suricata 8.0.0-dev documentation does not mention such cases.
Then, i would use this to alter some rules
From:
alert http $HOME_NET any -> $EXTERNAL_NET any ...
To:
alert http $HOME_NET any -> $EXT_NOT_YAHOO any ...
Yahoo is just an example:)