IDSTower 3.2.0 is out. Here is what is new for people running Suricata with a vendor ruleset.
Your changes and the vendor’s are kept apart. A rule’s action, priority, target and threshold each show the value that is applied; one you changed is marked Overridden, next to what the rule text says. Sensors and exports get your change where you made one and the rule text’s value everywhere else, so a vendor’s update still reaches every value you did not change. Vendors often edit a rule without bumping its revision; those edits now reach the rule’s values too.
Sensor updates over 5x faster. Four sensors pulling 51,764 ET Open rules at once now get them in 3.3 s instead of 17.5 s, with 0.3 GB of server memory instead of 3.4 GB (measured against a production-like MariaDB; the changelog says how). Exports are faster too: the same rules export in 2.4 s instead of 13.7 s.
Change many rules at once. Set the priority, target or threshold of the selected rules from one menu. Reset To Default removes your override, so those rules follow the rule text again.
Three more operating systems. Kali Linux, Ubuntu 26.04 and Raspberry Pi OS (64-bit), as managed hosts and as the IDSTower server. On Arm, installing IDSTower is tested on emulated containers; deploying Suricata to real Arm hardware has not been validated yet.
The release also includes various bug fixes. Full changelog: 3.2.0 Detailed Changelog - IDSTower Documentation