<Error> - [ERRCODE: SC_ERR_NO_RULES_LOADED(43)] - Loading signatures failed

You should be able to manage Emerging Threats rules with suricata-update. Just make sure you have the et/open set enabled. Its enabled by default usually, but just to be sure:

suricata-update enable-source et/open

the run suricata-update to pull down the latest et/open rules. This will update your /var/lib/suricata/rules/suricata.rules to contain all the enabled et/open rules.

If you want to enable a specific rule that is disabled by default, you can edit /etc/suricata/enable.conf. To disable a rule that you don’t want enabled, you can edit /etc/suricata/disable.conf. Examples of these configuration files can be found at https://suricata-update.readthedocs.io/en/latest/update.html#example-configuration-to-enable-rules-enable-conf as they don’t exist by default.

If you plan to cut and paste rules into a rule file that you find off the web, I suggest updating your suricata.yaml to look like:

default-rule-path: /var/lib/suricata/rules

rule-files:
  - suricata.rules
  - /etc/suricata/local.rules

then adding any custom rules to /etc/suricata/local.rules then restart Suricata as needed.

1 Like