# How to keep edited rules alert-\>drop

**URL:** <https://forum.suricata.io/t/how-to-keep-edited-rules-alert-drop/5767>\
**Category:** Rules\
**Tags:** ips, rules, suricata\
**Created:** [June 10, 2025, 8:49pm UTC](https://forum.suricata.io/t/how-to-keep-edited-rules-alert-drop/5767 "2025-06-10T20:49:24Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pulasthi91](https://avatars.discourse-cdn.com/v4/letter/p/5f9b8f/32.png) [@Pulasthi91](https://forum.suricata.io/u/Pulasthi91)\
**Post date:** [June 10, 2025, 8:49pm UTC](https://forum.suricata.io/t/how-to-keep-edited-rules-alert-drop/5767/1 "2025-06-10T20:49:24Z")

</div>

I am running suricata inline mode and I am changing alert → drop all the rules related to malicious traffics and I am making those changes in suricata.rule file. Everytime I run the suricata-update rules changes to alert mode. Appreciate the assistance how to make those changes permeant. I tried .modify but its not working

---

<div class="post-metadata">

**Author:** ![ish](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/ish/32/8_2.png) [@ish](https://forum.suricata.io/u/ish)\
**Post date:** [June 10, 2025, 9:07pm UTC](https://forum.suricata.io/t/how-to-keep-edited-rules-alert-drop/5767/2 "2025-06-10T21:07:50Z")

</div>

You will want to create a `drop.conf` file. In this file you can list the SIDs, one per line that you wanted converted to `drop`. Suricata-Update will then convert them.

Typically this file is kept at `/etc/suricata/drop.conf`, but it will really depend on how you installed Suricata. If its not being picked up, you can provided it on the command line:

```auto
suricata-update --drop-conf /etc/suricata/drop.conf

```

---

<div class="post-metadata">

**Author:** ![Pulasthi91](https://avatars.discourse-cdn.com/v4/letter/p/5f9b8f/32.png) [@Pulasthi91](https://forum.suricata.io/u/Pulasthi91)\
**Post date:** [June 11, 2025, 2:45pm UTC](https://forum.suricata.io/t/how-to-keep-edited-rules-alert-drop/5767/3 "2025-06-11T14:45:26Z")

</div>

It works. Thank you very much for the swift response. I would like to know is there a way to drop rule base on words. following are I am trying to drop.

msg:"ET CINS Active Threat Intelligence Poor Reputation IP  
msg:"ET SCAN Suspicious inbound  
msg:"ET TA\_ABUSED  
msg:"ET EXPLOIT Realtek  
msg:"ET CINS Active Threat Intelligence  
msg:"ET CNC Feodo Tracker  
msg:"ET [Threatview.io](http://Threatview.io)  
msg:"ET COMPROMISED Known Compromised  
signature\_severity Major

Thank you

---

<div class="post-metadata">

**Author:** ![Pulasthi91](https://avatars.discourse-cdn.com/v4/letter/p/5f9b8f/32.png) [@Pulasthi91](https://forum.suricata.io/u/Pulasthi91)\
**Post date:** [June 11, 2025, 4:24pm UTC](https://forum.suricata.io/t/how-to-keep-edited-rules-alert-drop/5767/4 "2025-06-11T16:24:15Z")

</div>

Found a solution  
by using following I am able to block  
metadata: tag “put the tag name”