# Rules from Suricata-update are not getting loaded

**URL:** <https://forum.suricata.io/t/rules-from-suricata-update-are-not-getting-loaded/4507>\
**Category:** Help\
**Created:** [February 28, 2024, 9:36am UTC](https://forum.suricata.io/t/rules-from-suricata-update-are-not-getting-loaded/4507 "2024-02-28T09:36:42Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![gbL2k](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/gbl2k/32/2732_2.png) [@gbL2k](https://forum.suricata.io/u/gbL2k)\
**Post date:** [February 28, 2024, 9:36am UTC](https://forum.suricata.io/t/rules-from-suricata-update-are-not-getting-loaded/4507/1 "2024-02-28T09:36:42Z")

</div>

Hello everyone!

My goal is to be able to feed suricata from misp with rules and the only thing left is to figure out why rules downloaded by suricata-update are not loaded into the suricata.rules file.The misp api’s output format is like this:

```auto
# MISP export of IDS rules - optimized for 
#
# These NIDS rules contain some variables that need to exist in your configuration.
# Make sure you have set:
#
# $HOME_NET - Your internal network range
# $EXTERNAL_NET - The network considered as outside
# $SMTP_SERVERS - All your internal SMTP servers
# $HTTP_PORTS - The ports used to contain HTTP traffic (not required with suricata export)
# 
rule
rule

```

Anyone had the same problem before?

---

<div class="post-metadata">

**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\
**Post date:** [February 28, 2024, 8:36pm UTC](https://forum.suricata.io/t/rules-from-suricata-update-are-not-getting-loaded/4507/2 "2024-02-28T20:36:03Z")

</div>

What version of `suricata-update` are you using?  
How do you run it?  
Did you configure anything related to the MISP source?  
Provide the output of the `suricata-update` run.

---

<div class="post-metadata">

**Author:** ![gbL2k](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/gbl2k/32/2732_2.png) [@gbL2k](https://forum.suricata.io/u/gbL2k)\
**Post date:** [February 29, 2024, 9:46am UTC](https://forum.suricata.io/t/rules-from-suricata-update-are-not-getting-loaded/4507/3 "2024-02-29T09:46:58Z")

</div>

I’m on version 7.0.2.  
I run suricata-update with the following command:  
`suricata-update --no-check-certificate` and configured the source with this one:  
`suricata-update add-source --http-header " Authorization: API_KEY" mispsource https://MISP_IP/events/nids/suricata/download/MISP_EVENT_ID`  
On misp side there seems to be no problem the answer from the API should be ingestible by suricata.  
Output of suricata-update is strange because it says it successfully fetched the rules.

```auto
29/2/2024 -- 07:41:22 - <Info> -- Checking https://misp_ip/events/nids/suricata/download/1701.md5.
29/2/2024 -- 07:41:23 - <Info> -- Fetching https://misp_ip/events/nids/suricata/download/1701.
 100% - 1182/1182
29/2/2024 -- 07:41:24 - <Info> -- Done

```

---

<div class="post-metadata">

**Author:** ![ish](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/ish/32/8_2.png) [@ish](https://forum.suricata.io/u/ish)\
**Post date:** [February 29, 2024, 3:21pm UTC](https://forum.suricata.io/t/rules-from-suricata-update-are-not-getting-loaded/4507/4 "2024-02-29T15:21:29Z")

</div>

Current `suricata-update` will only look for rules in files that end in `.rules`, as rulesets can contain other types of files.

Are you able to change things such that you are downloading `https://misp_ip/events/nids/suricata/download/1701.rules`? Then it should work. We do have an open issue for this and it shouldn’t be too hard to fix:

> **[Bug #3664: Removing filename ends with ".rules" requirement for URL feeds of...](https://redmine.openinfosecfoundation.org/issues/3664)**
>
> Redmine

---

<div class="post-metadata">

**Author:** ![gbL2k](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/gbl2k/32/2732_2.png) [@gbL2k](https://forum.suricata.io/u/gbL2k)\
**Post date:** [February 29, 2024, 4:52pm UTC](https://forum.suricata.io/t/rules-from-suricata-update-are-not-getting-loaded/4507/5 "2024-02-29T16:52:49Z")

</div>

I have changed the URL and misp gives back the same answer as without the .rule ending, it seems like it ignores anything after the ID for some reason, anyway its working now.

Thanks!