So, a relative newbie to suricata, but I am having problems with a rule. Even when I make this the only signature in a ruleset, the engine never fires this alert. alert ssh any any → any any (msg:“Corporate policy violation, detected SSH protocol”; content:“SSH-”; target:dest_ip; sid:1000013; rev:1…

SSH rule not working

Jeff_Lucovsky (Jeff Lucovsky) April 3, 2023, 12:34pm 14

You can also set this in the Suricata configuration file:

capture:
  check-sum-validation: none

Ssh and http protocol rule not work

Topic		Replies	Views
Ssh and http protocol rule not work Help suricata	4	299	August 7, 2024
SSH alert direction Rules	7	1159	October 10, 2023
Testing ssh related rules Rules rules	1	261	April 4, 2024
Suricata 6.0.0 not logging the same alert as 4.1.4 Help	5	529	May 26, 2021
TLS rule alert on CN name not picking up Rules	5	2008	June 24, 2021