How to exclude a rule from Suricata?

After a default install of Suricata, ET/Open rules are enabled by default. You should not download them to /usr/share/…

Instead just run suricata-update, by default it will download the ET/Open rules and output them to /var/lib/suricata/rules/suricata.rules applying any changes you may have configured in /etc/suricata/disable.conf, /etc/suricata/enable.conf, etc.

I’d ignore other guides and stick to our official documentation if possible:
https://suricata.readthedocs.io/en/suricata-6.0.2/quickstart.html#

Hope that helps.

1 Like