# Suricata-update and disable/modify rule help

**URL:** <https://forum.suricata.io/t/suricata-update-and-disable-modify-rule-help/5880>\
**Category:** Help\
**Tags:** suricata-update, suricata\
**Created:** [July 18, 2025, 9:27am UTC](https://forum.suricata.io/t/suricata-update-and-disable-modify-rule-help/5880 "2025-07-18T09:27:31Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![atbohmer](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/atbohmer/32/1853_2.png) [@atbohmer](https://forum.suricata.io/u/atbohmer)\
**Post date:** [July 18, 2025, 9:27am UTC](https://forum.suricata.io/t/suricata-update-and-disable-modify-rule-help/5880/1 "2025-07-18T09:27:31Z")

</div>

Hello,

Is it possible with suricata-update modify.conf/disable.conf to disable all ET/ETPRO rules with the following content: alert http $EXTERNAL\_NET any → $HOME\_NET any (msg:"ET SCAN

More specific source is $EXTERNAL\_NET and msg starts with “ET SCAN” or “ETPRO SCAN” .  
Or maybe better to change $EXTERNAL\_NET to $HOME\_NET as source to keep track on internal scanning?

I think excluding “ET SCAN” rules hits on a particular network spanport/interface is unable?

Reason is it is filling op the pcap directory where I save pcap files from alerts because like everyone else we are port scanned around the clock 24/7 a lot.

Any help appriciated!  
Cheers,  
Andre

---

<div class="post-metadata">

**Author:** ![jonny5](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jonny5/32/347_2.png) [@jonny5](https://forum.suricata.io/u/jonny5)\
**Post date:** [July 22, 2025, 2:12am UTC](https://forum.suricata.io/t/suricata-update-and-disable-modify-rule-help/5880/2 "2025-07-22T02:12:43Z")

</div>

The following regex should work in your disable.conf

```auto
re:alert http \\$EXTERNAL_NET any*.(ET|ETPRO) SCAN

```

Here’s my shareable suricata-update conf files to help with regex and other things you might get interested in:

> **[GitHub - j0nny55555/noiseless-suricata-update: Suricata update files focused on preventing FPs...](https://github.com/j0nny55555/noiseless-suricata-update)**
>
> Suricata update files focused on preventing FPs and other Noise