AirGapped ETOpen Update

[concepture]

Hello,
I'm using Security Onion 2.3 in an air-gapped setup. I'd like to update the ETOpen rules without updating the entire system (i.e., not using soup). Is this possible? Should I use sudo so-rule-update?

Thank you for the assistance!

[dougburks]

Have you checked the Airgap section of the documentation? It talks about ETPRO but in theory you should be able to do the same for ETOpen:
https://docs.securityonion.net/en/2.3/airgap.html#rule-updates