Hi there! Please help.
I am new to Suricata and I installed Suricata 8.0.7 from source on Debian Trixie 13 and all folders are under /usr/local/…
I RTFM, actually sections of it to get Suricata installed and basically running. Interestingly when I cd into /usr/local/var/suricata and “ls” all I see are empty “certs” and “files” directories, no suricata.log? I setup a local user(not using root) with proper permissions to the needed directories.
I run “suricata-update”:
– Using data-directory /usr/local/var/lib/suricata.
2/10/2026 – 12:34:49 - – Using Suricata configuration /usr/local/etc/suricata/suricata.yaml
2/10/2026 – 12:34:49 - – Using /usr/local/share/suricata/rules for Suricata provided rules.
2/10/2026 – 12:34:49 - – Found Suricata version 8.0.7 at /usr/local/bin/suricata.
2/10/2026 – 12:34:49 - – Loading /usr/local/etc/suricata/suricata.yaml
I am using ET Open and receive msg loading distribution rule files about 20 of them:
--Writing rules to /usr/local/var/lib/suricata/rules/suricata.rules: total: 69030; enabled: 53073; added: 77; removed 3; modified: 1322
2/10/2026 – 12:35:03 - – Writing /usr/local/var/lib/suricata/rules/classification.config
2/10/2026 – 12:35:03 - – Testing with suricata -T.
Then I receive these error mgs about “file.magic”??
-- unknown rule keyword ‘file.magic’.
2/10/2026 – 12:35:04 - – error parsing signature “alert tcp any any → $HOME_NET any (msg:“ET EXPLOIT 7-Zip 7z File PPMd Properties Parsing Integer Underflow (CVE-2023-31102)”; flow:established,to_client; file.magic; content:“7-zip archive”; startswith; file.data; content:“7z|bc af 27 1c 00 30 00 00|”; startswith; fast_pattern; pcre:”/\x30{24,}\x00\x30{24,}\x17\x06\x1a\x01/“; filesize:<10000; reference:url, Integer Overflow in 7zip (CVE-2023-31102) :: ds-security.com — A blog about IT-Security Research ; reference:cve,2023-31102; classtype:misc-attack; sid:2065690; rev:1; metadata:attack_target Client_Endpoint, created_at 2025_11_06, cve CVE_2023_31102, deployment Perimeter, deployment Internal, confidence Low, signature_severity Minor, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_11_06; target:dest_ip;)” from file /usr/local/var/lib/suricata/rules/suricata.rules at line 12077
I am receiving approx 9 – unknown rule keyword ‘file.magic’ errors? The above example is related to an ET Exploit but the rest are related to "ET HUNTING Observed Zip Slip in TAR Archive or ZIP Archive.
Then – Loading signatures failed.
2/10/2026 – 12:35:07 - – Suricata test failed, aborting.
2/10/2026 – 12:35:07 - – Restoring previous rules.
I ran the error msg through my local LLM for assistance:
Summary:
Suricata failed to load a security rule because it encountered an unsupported keyword: file.magic.
Key Details:
Error: The engine does not recognize file.magic as a valid instruction.
Affected Rule: sid:2065690 (relating to a 7-Zip integer underflow exploit, CVE-2023-31102).
Location: /usr/local/var/lib/suricata/rules/suricata.rules at line 12077.
Impact: This specific rule is currently inactive and will not be monitored by the IDS.
Cause:
This usually happens because the rule was written for a different version of Suricata, contains a syntax error, or was intended for a different IDS engine (like Snort) that uses different naming conventions. To fix this, the file.magic; keyword needs to be removed or corrected to a supported Suricata command.
Is the LLM correct? What am I doing wrong and what do you suggest to fix these “file.magic” errors?
Thank you