Suricata configuration¶
In addition to downloading Suricata rulesets from multiple sources, Corelight-update can optimize the ruleset. It works by optionally applying Corelight recommended changes to the rulesets, and extracting content from Suricata rules and creating Zeek Intel rules with that content.
Content is only extracted from enabled rules and the “do_notice” flag can individually be set based on rule type. This means you can use the typical enable.conf and disable.conf rules to control what data is extracted. See Suricata policy settings for details.
Tip
No configuration is required to include local Suricata rulesets. See Locally Managed Sources for details.
Any “.rules” or “.rules.tar.gz” ruleset placed in the global-suricata folder is automatically available to all policies.
Any “.rules” or “.rules.tar.gz” ruleset placed in a local-suricata folder is automatically available to that policy.
Disabled Rules¶
By default, disabled rules are not written back to the final Suricata ruleset. If desired, disabled rules can be included in the ruleset file by enabling write_disabled_rules: true
in the Suricata policy settings.
Ruleset Testing¶
Once the ruleset is created, if Suricata is available on the host running Corelight-update, the ruleset can be tested with Suricata in test mode. If any of the following Suricata configuration files are placed in the policy configuration folder, they are used automatically when testing the Suricata ruleset:
suricata.yaml
classification.config
reference.config
threshold.config
Tip
The policy can be configured to pull Suricata configuration files from remote sources if desired. See Suricata policy settings.
By default, Corelight-update attempts to test the ruleset using Suricata. If Suricata is not available, Corelight-update logs that it did not test the ruleset and continues. If the rulesets is tested, and one or more rules fail the test, the details of the failed rules are logged and processing continues. Optionally, Corelight-update can be configured to discard a failed ruleset after the failed rules have been logged. See Suricata policy settings for settings.
See the following sections for more details: