Hello, I need help understanding how Suricata rules work. I’m trying to disable all the rules using the disable.conf file, but some rules are still active. Is this normal, or is there a problem? Is there a command to list Suricata rules? I haven’t added any external rules, just my disable.conf with these groups:
I’m not sure if the rules are disabled because many are commented out, but a large part remains active. I want to keep certain rules like FTP and SSH, and also create my own rules (I’ve found how to do this in the documentation).
Is there another method if this doesn’t work, maybe by commenting out in suricata.yaml and copying the FTP, SSH, etc. rules from Suricata and creating my own rules in the /etc/suricata/rules/local.rules file:
This likely won’t get all the rules as ET/open rules are also downloaded by default.
When I want to disable all rules I’ll use a modify.conf that looks like:
re: .
As disable is done after enable, this will disable all rules.
However, in some cases where you only want to run a small number of hand-maintained or written rules its just easier to not use Suricata-Update. Instead I’d modify suricata.yaml and just point it at my rule file, say /etc/suricata/local.rules or something.
I’ve tried several methods and managed to get it working, though I’m not sure if it’s the correct way. As long as it works, that’s what matters.
Disabling Rules
First, I managed to disable all groups in the disable.conf file using this method, which I find quite effective. It disabled all the rules:
group:*
Activating Specific Rules
Next, I wanted to activate the groups I was interested in by adding them to the activate.conf file. The only problem is that the suricata-update command compiles/generates the suricata.rules file, but it’s empty due to an issue.
I’m not sure if this method exists or if the documentation is outdated, but I couldn’t find anything. It might be useful to read both files (disable and enable) and compare them to avoid errors. This could simplify things.
Improvement Suggestions
I also recommend adding a command to display all rules, sorted by color or by state (enabled/disabled), as I found nothing in the documentation or forums.
My Solution
Here’s the solution I found for disabling all the rules using the documentation and the suricata-update -v command, which provided the locations of most rules as well as the zip file containing all the rule files.