So, a relative newbie to suricata, but I am having problems with a rule. Even when I make this the only signature in a ruleset, the engine never fires this alert. alert ssh any any → any any (msg:“Corporate policy violation, detected SSH protocol”; content:“SSH-”; target:dest_ip; sid:1000013; rev:1…

SSH rule not working

Jeff_Lucovsky (Jeff Lucovsky) April 3, 2023, 12:34pm 14

You can also set this in the Suricata configuration file:

capture:
  check-sum-validation: none

Ssh and http protocol rule not work

Topic		Replies	Views
SSH alert direction Rules	7	804	October 10, 2023
Suricata 6.0.0 not logging the same alert as 4.1.4 Help	5	490	May 26, 2021
TLS rule alert on CN name not picking up Rules	5	1848	June 24, 2021
Suricata ruleset help Help	7	626	July 14, 2023
Suricata HTTP rules not working Rules	4	607	February 17, 2023