You should be able to manage Emerging Threats rules with suricata-update
. Just make sure you have the et/open
set enabled. Its enabled by default usually, but just to be sure:
suricata-update enable-source et/open
the run suricata-update
to pull down the latest et/open
rules. This will update your /var/lib/suricata/rules/suricata.rules
to contain all the enabled et/open
rules.
If you want to enable a specific rule that is disabled by default, you can edit /etc/suricata/enable.conf
. To disable a rule that you don’t want enabled, you can edit /etc/suricata/disable.conf
. Examples of these configuration files can be found at https://suricata-update.readthedocs.io/en/latest/update.html#example-configuration-to-enable-rules-enable-conf as they don’t exist by default.
If you plan to cut and paste rules into a rule file that you find off the web, I suggest updating your suricata.yaml
to look like:
default-rule-path: /var/lib/suricata/rules
rule-files:
- suricata.rules
- /etc/suricata/local.rules
then adding any custom rules to /etc/suricata/local.rules
then restart Suricata as needed.