Hi everyone!
I need an advice, how i can sync suricate rules, include suppressions and trashholds, between multiple suricatas install?
Thx community for u hard and great work!
One way is to manage rules and threshold.config on a system separate from the suricata instances and then distribute the rules/config file to each instance.
There are other ways, of course, but this is a straightforward way.
I have already try this way, but after actions->build and push threshold.config back to previous version(
What about other ways?
Could you explain that process more?
Sure, at first config sources at all IDS (i use Scirius CE, if it important), update all rulse, then go to suricata->ruleset actions->build&push, after copy from IDS-1 /etc/suricata/rules/ two files: threshold.config and scirius.rules to another IDS and same action “go to suricata->ruleset actions->build&push”.
What i do wrong?
There’s nothing wrong with this approach – thanks for the additional context.
But it doesn’t work(