Suricatac add single rule

Does suricatac (the socket) have the ability to add / modify a single rule? I know the socket allows reloading rules, but a single rule? Would you consider any effort in updating that part of suricatac to include the addition / modification based on SID etc.

Are you asking if suricatasc can be used to add a single rule to an existing ruleset?

If so, the answer is no. What you can do is

echo "some-new-rule" >> /path/to/existing/suricata.rules
suricatasc -c ruleset-reload-rules
1 Like

Ok… wow, that’s heaps better than what I was hoping to achieve!

I was interested in the suricatac commands and building my own client as per the documentation, however the commands in there are very well developed & mature. I am a little frustrated that, of course, pcap commands have been taken out, and was there any good reason for that?

Use the runmode unix-sockets if you want to use the pcap commands:

suricata --runmode=unix-socket ... and then use suricatasc