Suricata-update activate commented rule

1

After downloading the ET rule file, I commented out the unused rules.

After executing suricata-update, suricata.rules file was created, but the rule I commented out was uncommented.

There was also a problem in that the rule registered in disable.conf for the rule with flowbit warning was continuously activated.

Doesn’t suricata-update check the presence or absence of comments when reading the rule file?
In order to disable the rule, is the only way to register in disable.conf?

스크린샷 2020-11-30 오전 11.06.39
스크린샷 2020-11-30 오전 11.06.391269×258 67.2 KB

[warning: sid 2016502]

스크린샷 2020-11-30 오전 11.07.46
스크린샷 2020-11-30 오전 11.07.461286×446 50.3 KB

[sid 2016502 rule is commented]

2

No it doesn’t. Suricata-Update downloads rules, processes those rules by applying the disables, enables, modifies, etc. The writes out suricata.rules. It is unaware of edits you made directly to the output file.