Truing up deleted rules with threshold file

It would be interesting to see if it would be possible to have suricata-update handle that in the future since it is aware of the status of rules.

Currently though, as you said, you would need to have a list of active/enabled sids and run that against your threshold contents. I am not sure of any options in the current suricata or related tools that would do it automagically for you.

JT

1 Like