Local rules not working? #12284
-
Hello everyone. I've been experimenting all day with adding local rules, but haven't gotten any positive results.
I still don’t see local alerts, but only default ones from all.rules. I even see events in Hunt and the traffic matches these local rules, but there is no alert. Can anyone help? |
Beta Was this translation helpful? Give feedback.
Replies: 2 comments
-
Beta Was this translation helpful? Give feedback.
-
Beta Was this translation helpful? Give feedback.
Looks like your last rule is missing
:
after the sidalert icmp any any -> $HOME_NET any (msg:"ICMP Test"; sid:1000004; rev:1;)
I went and added those rules to my idstools -> rules -> local rules
Then clicked the 'Synchronize grid' button at the top of SOC and I started to get alerts for the new rules (after about 15 minutes for the grid sync to complete)