Does suricatac (the socket) have the ability to add / modify a single rule? I know the socket allows reloading rules, but a single rule? Would you consider any effort in updating that part of suricatac to include the addition / modification based on SID etc.
Hi,
Are you asking if suricatasc can be used to add a single rule to an existing ruleset?
If so, the answer is no. What you can do is
echo "some-new-rule" >> /path/to/existing/suricata.rules
suricatasc -c ruleset-reload-rules
1 Like
Ok… wow, that’s heaps better than what I was hoping to achieve!
I was interested in the suricatac commands and building my own client as per the documentation, however the commands in there are very well developed & mature. I am a little frustrated that, of course, pcap commands have been taken out, and was there any good reason for that?
Use the runmode unix-sockets if you want to use the pcap commands:
suricata --runmode=unix-socket ... and then use suricatasc