One of the areas I’m currently working on for Suri Oculus 4.0 is improving the management of local Suricata rules.
Many Suricata deployments eventually accumulate a growing collection of custom rules. These may include internal detections, IoC-based rules, environment-specific signatures, or temporary rules created during investigations.
Managing these rules directly in local.rules works well for small rule sets, but it becomes increasingly difficult as the number of rules grows.
The goal of the new Local Rules Management page is to simplify these daily tasks while remaining fully compatible with the standard Suricata workflow.
Current functionality includes:
- Viewing all local rules in a single interface.
- Fast search by SID, message, or rule content.
- Creating new local rules.
- Editing existing rules.
- Enabling and disabling rules.
- Saving changes directly to local.rules.
No proprietary rule format is introduced. Suri Oculus continues to use the standard local.rules file, so administrators can switch freely between the graphical interface and manual editing whenever they prefer.
This feature is part of the ongoing work toward Suri Oculus 4.0. After completing Local Rules Management, the next development steps will focus on:
- Alert/Drop rule action management.
- A searchable Suricata Rule Knowledge Base.
- An integrated IoC Knowledge Base.
As always, comments and suggestions from the Suricata community are welcome.