Hi! I wrote a few rules and I want them to be active from 9 to 5 - working hours. I don’t want to disable suricata services, I just want those rules to be disabled after ppl are not working anymore, but when they come back to work at 9, they should enable themselves again.
Is there a way to do this? Is it possible? Thank you for your time!
You could use a cron job on your sensors to switch out rule files with/without these rules on weekdays at 9 and 5 and then trigger a rule reload via suricatasc ruleset-reload-rules, which should be pretty much seamless.
Thank you for your suggestion, I’ll give it a try!
So. I only have disable.conf, there is no enable.conf for me in my suricata files so I kinda took advantage of it.
I created another .rules with the rule I wanted to disable/enable (a pass-action rule).
I made two cronjobs, one 9-5, enabling the pass rule by renaming disable.conf into enable.conf and restarting/reloading suricata service/rules and another one 5-9 disabling the pass rule by renaming again enable.conf into disable.conf
I hope somebody finds this useful somehow.