Suricata-update and local file modifies

Rules
1

I am using suricata-update (version 1.3.3) and have a local file with some custom signatures. There are some cases where depending on the suricata/nsm appliance the rules are destined for, where some of the signatures in the local file need to be modified. It seems like suricata-update is not modifying local file sid entries in the modify.conf file. Is this unexpected behavior? I didn’t see any tickets so wondering if this is just an edge case. Thanks in advance!

JT

2

Can you generate a rather simple example with configs we could use to try to replicate the issue?

3

How are you specifying your local rules?

I just did a test using --local /path/to/my/local.rules and the modified versions ended up in the output.

4

Thank you both. Looks like it’s probably something on my end. I just tried another simplified version and it worked as expected.

JT