Adding new rules

[Perry1000]

I am trying to add a custom rule to detect reverse shell. Can anyone help me with this.
Also I have been following documentation to adding new rules, but i have not been successful with it.
Can someone give me an example on how i can achieve this and add custom rule on security onion.

[robbiemarshall]

When you say you haven't been successful adding rules, where are you having issues?

[Perry1000]

i added new rules to this location /opt/so/saltstack/local/salt/idstools/local.rules.
i did vi local.rules to add the new rule

after i tried to run this command sudo salt-call state.highstate. However, it gave an error.

is that the right process of adding a new rule

[robbiemarshall]

What was the error you received? Did you add the new rule to that location on the manager node if you have a distributed grid? Have you checked the suricata logs for errors at /opt/so/log/suricata/suricata.log?