add a classification and tune a rule's severity level to high on suricata

[js-messi]

I want to add a custom suricata rule on security-onion 2,
according from manual,
I add it in /opt/so/saltstack/local/salt/idstools/local.rules
alert ip 10.x.x.x any -> any any (msg:"test!";classtype:test;sid:1999999;)
but it's "low " severity level by default and it's shown blank in Security Onion-Rule-Category
I don't know how can I modify the severity level from low to high and how it can be shown on Security Onion-Rule-Category,thanks!

[InfosecGoon]

To set the category and severity, use the "classtype" directive and rather than test include one of the categories from /opt/so/conf/suricata/classification.config.

For example, setting it to "classtype:trojan-activity" would set it to high priority.

[js-messi]

Hi Gracie,

Thanks for your reply, how to add a classtype and set the serverity?

[InfosecGoon]

If you want to use one of the built-in classtypes, you can just copy the name from the classification.config file.

If you want to add a new classtype, you can do that by modifying /opt/so/saltstack/local/pillar/global.sls and adding something like this:

 

suricata:
  classification:
    test-classification:
      description: Testing
      priority: 1

[js-messi]

Thanks a lot for your reply,I try to add a new classtype on global.sls and use it on a test rule,it's shown on kibana alert,but on security onion-rule-catagory(lower left),it's blank,can you tell me how to add this new classtype to catagory?

[InfosecGoon]

It should be pulling that category name from classification.config.

Can you share your custom rule and the /opt/so/conf/suricata/classification.config file?

[js-messi]

Hi Gracie, Thanks for your reply, how to add a classtype and set the serverity? Matthew Gracie ***@***.***>于2023年6月27日 周二04:11写道：

…

To set the category and severity, use the "classtype" directive and rather than test include one of the categories from /opt/so/conf/suricata/classification.config. For example, setting it to "classtype:trojan-activity" would set it to high priority. — Reply to this email directly, view it on GitHub <#10659 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ANMWB65K74UMF4QMKZNGJ2LXNHUIJANCNFSM6AAAAAAZT4552A> . You are receiving this because you authored the thread.Message ID: <Security-Onion-Solutions/securityonion/repo-discussions/10659/comments/6286143 @github.com>