# Improving Rule Management in Suri Oculus

**URL:** <https://forum.suricata.io/t/improving-rule-management-in-suri-oculus/6348>\
**Category:** Community Announcements\
**Created:** [May 27, 2026, 1:54pm UTC](https://forum.suricata.io/t/improving-rule-management-in-suri-oculus/6348 "2026-05-27T13:54:25Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![fil104](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/fil104/32/3905_2.png) [@fil104](https://forum.suricata.io/u/fil104)\
**Post date:** [May 27, 2026, 1:54pm UTC](https://forum.suricata.io/t/improving-rule-management-in-suri-oculus/6348/1 "2026-05-27T13:54:25Z")

</div>

I am currently redesigning the rule management subsystem in [Suri Oculus](https://suri-oculus.com), a lightweight Suricata management and analysis platform.

At the moment, the Rules interface already supports:

- enable/disable of rules from the web interface;
- search by SID, action, signature and other parameters;
- detailed rule inspection;
- modification of existing rules;
- creation of local custom rules;
- fast runtime apply and Suricata reload.

One of the main goals now is to improve interaction with `suricata-update` and make rule state handling more predictable.

The planned changes include:

- persistent enable/disable handling through `disable.conf` and `enable.conf` ;
- separation of upstream rules, IOC-generated rules and local custom rules;
- proper handling of IDS vs IPS operating modes;
- IOC policy management instead of direct editing of generated IOC rules;
- synchronization between runtime rule state and persistent configuration.

I also plan to improve the internal lifecycle handling of rules to avoid conflicts during repeated enable/disable operations and ruleset updates.

The overall goal is to keep the system lightweight and practical, including for low-powered hardware, while still providing a more structured approach to Suricata rule management.

Screenshots below show:

1. Rules list and controls
2. Detailed rule information
3. Rule modification form  
 ![1r](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/2X/3/30b40eea3b113bd703943c7b7f459ebba84c6379.png)  
 ![2r](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/2X/3/311c2ff0bc90ae1b6272374d91c07aa64b5b02ba.png)  
 ![3r](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/2X/c/c3c94b68fe8f22cfd5a782dcf56d52efef647e09.png)