# Suricatac add single rule

**URL:** <https://forum.suricata.io/t/suricatac-add-single-rule/1676>\
**Category:** Developers\
**Created:** [September 3, 2021, 1:10am UTC](https://forum.suricata.io/t/suricatac-add-single-rule/1676 "2021-09-03T01:10:05Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![iain](https://avatars.discourse-cdn.com/v4/letter/i/d2c977/32.png) [@iain](https://forum.suricata.io/u/iain)\
**Post date:** [September 3, 2021, 1:10am UTC](https://forum.suricata.io/t/suricatac-add-single-rule/1676/1 "2021-09-03T01:10:05Z")

</div>

Does suricatac (the socket) have the ability to add / modify a single rule? I know the socket allows reloading rules, but a single rule? Would you consider any effort in updating that part of suricatac to include the addition / modification based on SID etc.

---

<div class="post-metadata">

**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\
**Post date:** [September 5, 2021, 2:08pm UTC](https://forum.suricata.io/t/suricatac-add-single-rule/1676/2 "2021-09-05T14:08:31Z")

</div>

Hi,  
Are you asking if `suricatasc` can be used to _add a single rule to an existing ruleset_?

If so, the answer is no. What you can do is

```auto
echo "some-new-rule" >> /path/to/existing/suricata.rules
suricatasc -c ruleset-reload-rules

```

---

<div class="post-metadata">

**Author:** ![iain](https://avatars.discourse-cdn.com/v4/letter/i/d2c977/32.png) [@iain](https://forum.suricata.io/u/iain)\
**Post date:** [September 6, 2021, 6:40am UTC](https://forum.suricata.io/t/suricatac-add-single-rule/1676/3 "2021-09-06T06:40:27Z")

</div>

Ok… wow, that’s heaps better than what I was hoping to achieve!

I was interested in the suricatac commands and building my own client as per the documentation, however the commands in there are very well developed & mature. I am a little frustrated that, of course, pcap commands have been taken out, and was there any good reason for that?

---

<div class="post-metadata">

**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\
**Post date:** [September 6, 2021, 1:05pm UTC](https://forum.suricata.io/t/suricatac-add-single-rule/1676/4 "2021-09-06T13:05:08Z")

</div>

Use the runmode `unix-sockets` if you want to use the pcap commands:

`suricata --runmode=unix-socket ...` and then use `suricatasc`