Modify examples

It is common to modify the source and/or destination of a rule. Multiple addresses or ranges of addresses can be assigned to the same rule. See the Suricata documentation for examples of source and destination operators.

This example modifies a rule so that it only matchs on traffic coming from all $HOME_NET sources except 192.168.0.1.

# disable signature for 192.168.0.1
#alert udp $HOME_NET any -> $EXTERNAL_NET [!3478,1023:] (msg:"ET INFO Session Traversal Utilities for NAT (STUN Binding Request On Non-Standard High Port)"; content:"|00 01|"; depth:2; content:"|21 12 a4 42|"; distance:2; within:4; reference:url,tools.ietf.org/html/rfc5389; metadata:created_at 2021_06_03, updated_at 2021_06_03; classtype:attempted-user; gid:1; sid:2033078; rev:2;)
2033078 SrcAddress:[$HOME_NET,!192.168.0.1]

Tip

The unedited rule was added as a comment just to document the original rule.

This example will modifies the rule so it matches any source except 192.168.0.1, and any destination except 192.168.0.2.

# disable signature 2031297 for traffic between 192.168.0.1 and 192.168.0.2
2031297 SrcAddress:!192.168.0.1
2031297 DestAddress:!192.168.0.2

This example modifies the rule so it matches all customer networks except customer “B”.

# enable signature 2027397 for all customer except "B" to any destination and updating the revision to 4
2027397 SrcAddress:[$All_CUSTOMERS,!$CUSTOMER_B]
2027397 DestAddress:any
2027397 Rev:4

The following example modifies the priority of all rules with a classtype of “attempted-user” to 1.

# modify the priority of all rules with a classtype of "attempted-user" to 1
Classtype:attempted-user Priority:1

The following example modifies all rules with a specific classtype to another classtype.

# Change all rule of Classtype "misc-activity" to a Classtype of "cool-activity"
Classtype:misc-activity Classtype:"cool-activity"