# Why are ET lists set to 'alert' and not 'block'?

**URL:** <https://forum.suricata.io/t/why-are-et-lists-set-to-alert-and-not-block/3441>\
**Category:** Rules\
**Created:** [April 21, 2023, 3:26pm UTC](https://forum.suricata.io/t/why-are-et-lists-set-to-alert-and-not-block/3441 "2023-04-21T15:26:46Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![gctwnl](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/gctwnl/32/1793_2.png) [@gctwnl](https://forum.suricata.io/u/gctwnl)\
**Post date:** [April 21, 2023, 3:26pm UTC](https://forum.suricata.io/t/why-are-et-lists-set-to-alert-and-not-block/3441/1 "2023-04-21T15:26:46Z")

</div>

After wresting with ET Telemetry Pro on OPNsense (and losing), I removed it and moved to ET Open. I turned a few on, like dshield, drop, and compromised.

What I noticed was that all of these come with rules that say ‘alert’, and not ‘block’. That surprised me. Why is that and how do I make Suricata to block them?

I am using Suricata on OPNsense 22

---

<div class="post-metadata">

**Author:** ![IDSTower](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/idstower/32/861_2.png) [@IDSTower](https://forum.suricata.io/u/IDSTower)\
**Post date:** [April 21, 2023, 3:45pm UTC](https://forum.suricata.io/t/why-are-et-lists-set-to-alert-and-not-block/3441/2 "2023-04-21T15:45:53Z")

</div>

You can make Suricata block them by changing “alert” to “drop” in the rules.  
It was set to alert by default since most of them do not require a block, for example “ET Info” alerts are informational and dose not indicate malicious activity.

So it is up to the user to decide what to block.

---

<div class="post-metadata">

**Author:** ![hydn](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/hydn/32/3579_2.png) [@hydn](https://forum.suricata.io/u/hydn)\
**Post date:** [May 15, 2025, 12:55pm UTC](https://forum.suricata.io/t/why-are-et-lists-set-to-alert-and-not-block/3441/3 "2025-05-15T12:55:01Z")

</div>

How can one mass-change all **emerging-tor.rules** to drop?

Edit: Would this work if added to SID drops?

```auto
group:emerging-tor.rules

```

---

<div class="post-metadata">

**Author:** ![hydn](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/hydn/32/3579_2.png) [@hydn](https://forum.suricata.io/u/hydn)\
**Post date:** [May 16, 2025, 6:15pm UTC](https://forum.suricata.io/t/why-are-et-lists-set-to-alert-and-not-block/3441/4 "2025-05-16T18:15:42Z")

</div>

I can confirm that does NOT work. Looks like I would have to enter them all (100’s) manually?

Is there a way to change the default action of this **emerging-tor.rules** ruleset?

Thanks

---

<div class="post-metadata">

**Author:** ![azuleonyx](https://avatars.discourse-cdn.com/v4/letter/a/f04885/32.png) [@azuleonyx](https://forum.suricata.io/u/azuleonyx)\
**Post date:** [May 19, 2025, 9:05pm UTC](https://forum.suricata.io/t/why-are-et-lists-set-to-alert-and-not-block/3441/5 "2025-05-19T21:05:36Z")

</div>

umm, probably easier to find/replace (or use sed) to update the rules. If you use `sed` or python, you can filter the rules, then change the action. For python, see [GitHub - jasonish/py-idstools: idstools: Snort and Suricata Rule and Event Utilities in Python (Including a Rule Update Tool)](https://github.com/jasonish/py-idstools). You can parse them, update the rules, and output a new rule file.

---

<div class="post-metadata">

**Author:** ![hydn](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/hydn/32/3579_2.png) [@hydn](https://forum.suricata.io/u/hydn)\
**Post date:** [June 8, 2025, 10:39pm UTC](https://forum.suricata.io/t/why-are-et-lists-set-to-alert-and-not-block/3441/6 "2025-06-08T22:39:22Z")

</div>

I got this to work:

 ![image](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/2X/2/26ba281336c6be66f2235b0b2905a1adc28190c5.png)