So, a relative newbie to suricata, but I am having problems with a rule. Even when I make this the only signature in a ruleset, the engine never fires this alert. alert ssh any any → any any (msg:“Corporate policy violation, detected SSH protocol”; content:“SSH-”; target:dest_ip; sid:1000013; rev:1…

SSH rule not working

Jeff_Lucovsky (Jeff Lucovsky) April 3, 2023, 12:34pm 14

You can also set this in the Suricata configuration file:

capture:
  check-sum-validation: none

Ssh and http protocol rule not work

Topic		Replies	Views
Suricata HTTP rules not working Rules	4	711	February 17, 2023
Rules for SSH under root Rules rules , suricata	2	429	April 11, 2024
Most simple rule with "content" keyword doesn't work Rules rules , suricata	1	96	July 31, 2024
Can't trigger custom rules Help	3	988	February 4, 2022
Suricata rule is not dropping SSH connections Rules	1	1337	November 27, 2021