ETPRO Rules do not load

[ben-sec]

Version

2.4.60

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

8

RAM

64

Storage for /

445 GB

Storage for /nsm

894 GB

Network Traffic Collection

tap

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hi!
I entered ETPRO and my Oink-Code in the SO web console, but it looks like SO is not pulling the ETPRO rules (at leasst I see no alarms that get triggered by ETPRO rules so far and I think the number of ETPRO rules is something like 70.000+, not only 48.420 ... see output below). so-rule-update has the following output:

2024-04-25 06:18:24,913 - <DEBUG> - This is idstools-rulecat version 0.6.5; Python: 3.9.7 (default, Aug 31 2021, 19:01:35) - [GCC 10.3.1 20210424]
2024-04-25 06:18:24,913 - <INFO> - Forcing Suricata version to 6.0.
2024-04-25 06:18:24,913 - <INFO> - Fetching https://rules.emergingthreatspro.com/my-oink-code/suricata-6.0.0/etpro.rules.tar.gz.
Traceback (most recent call last):
  File "/usr/local/bin/idstools-rulecat", line 12, in <module>
    sys.exit(main())
  File "/usr/local/lib/python3.9/site-packages/idstools/scripts/rulecat.py", line 845, in main
    files = Fetch(args).run()
  File "/usr/local/lib/python3.9/site-packages/idstools/scripts/rulecat.py", line 329, in run
    files.update(self.fetch(url))
  File "/usr/local/lib/python3.9/site-packages/idstools/scripts/rulecat.py", line 317, in fetch
    idstools.net.get(
  File "/usr/local/lib/python3.9/site-packages/idstools/net.py", line 55, in get
    remote = urlopen(url)
  File "/usr/local/lib/python3.9/urllib/request.py", line 214, in urlopen
    return opener.open(url, data, timeout)
  File "/usr/local/lib/python3.9/urllib/request.py", line 523, in open
    response = meth(req, response)
  File "/usr/local/lib/python3.9/urllib/request.py", line 632, in http_response
    response = self.parent.error(
  File "/usr/local/lib/python3.9/urllib/request.py", line 561, in error
    return self._call_chain(*args)
  File "/usr/local/lib/python3.9/urllib/request.py", line 494, in _call_chain
    result = func(*args)
  File "/usr/local/lib/python3.9/urllib/request.py", line 641, in http_error_default
    raise HTTPError(req.full_url, code, msg, hdrs, fp)
urllib.error.HTTPError: HTTP Error 403: Forbidden
2024-04-25 06:18:25,438 - <INFO> - Loading ./rulecat.conf.
2024-04-25 06:18:25,439 - <INFO> - Fetching http://my-manager:7788/suricata/emerging-all.rules.
 100% - 28367328/28367328
2024-04-25 06:18:25,527 - <INFO> - Done.
2024-04-25 06:18:25,533 - <INFO> - Loading local file /opt/so/rules/nids/suri/local.rules
2024-04-25 06:18:26,914 - <INFO> - Loaded 48420 rules.
2024-04-25 06:18:26,918 - <INFO> - Disabled 0 rules.
2024-04-25 06:18:26,918 - <INFO> - Enabled 0 rules.
2024-04-25 06:18:26,918 - <INFO> - Modified 0 rules.
2024-04-25 06:18:26,918 - <INFO> - Dropped 0 rules.
2024-04-25 06:18:26,983 - <INFO> - Enabled 0 rules for flowbit dependencies.
2024-04-25 06:18:28,738 - <INFO> - Writing rules to /opt/so/rules/nids/suri/all.rules: total: 48420; enabled: 36881; added: 0; removed 0; modified: 0
2024-04-25 06:18:28,916 - <INFO> - Done.

Any ideas?

Cheers, Ben

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[ben-sec]

Sorry, it turns out that our supplier did not purchase the licenses in time and they are currently not valid. That's why the oink code is not working.