SO 2.4.70 Detections - Bulk Rule Tuning Possible? #13106
-
Version2.4.70 Installation MethodSecurity Onion ISO image Descriptionconfiguration Installation TypeStandalone Locationon-prem with Internet access Hardware SpecsExceeds minimum requirements CPU48 RAM512G Storage for /445.07 GiB Storage for /nsm11.64 TiB Network Traffic Collectiontap Network Traffic SpeedsLess than 1Gbps StatusYes, all services on all nodes are running OK Salt StatusNo, there are no failures LogsNo, there are no additional clues DetailHello, I've just updated to SO 2.4.70 and I'm wondering if there is any way to bulk add Suricata rule thresholds now that the Detections interface has launched? I have too many thresholds to reasonably add them one at a time in the webui. The old interface at suricata->thresholding->SIDS is now read-only. Thanks! Guidelines
|
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 9 replies
-
|
I agree with OP that bulk tuning could be beneficial. For example, a way to suppress rules based on regular expressions could allow for disabling all dynamic dns rules or all ET POLICY rules at once. Us home users are not interested in Steam or Discord related alerts. |
Beta Was this translation helpful? Give feedback.
-
|
I'm going to add another note to this thread. Unless I reload the detection/tuning_tab page between write operations, I get a popup error "A detection with this public Id already exists. Please choose a different public Id." when the next write operation is attempted. |
Beta Was this translation helpful? Give feedback.
-
|
I created custom suricata address-groups for the lists of CIDR blocks I want to use in suppression rules. Unfortunately, the regex check on the Detections->Tuning interface for the "IP - CIDR Notation" field won't allow the use of address-group names nor lists of CIDR blocks as inputs though they are supported by Suricata 7.0.5. |
Beta Was this translation helpful? Give feedback.
-
|
I'm out of ideas. I'm going to resign myself to disabling instead of tuning noisy rules when the tuning requires anything more than a handful of CIDR blocks. |
Beta Was this translation helpful? Give feedback.
-
|
I'm following up on this issue in case others encounter the same. With the release of SO 2.4.80, FEATURE: Support Suricata VARs for Overrides #13194 plus custom suricata address-groups [Configuration -> suricata -> advanced ] provided a path forward to accomplish this flavor of tuning task without having to click through adding each CIDR individually in the WebUI. Thanks! |
Beta Was this translation helpful? Give feedback.
I'm following up on this issue in case others encounter the same. With the release of SO 2.4.80, FEATURE: Support Suricata VARs for Overrides #13194 plus custom suricata address-groups [Configuration -> suricata -> advanced ] provided a path forward to accomplish this flavor of tuning task without having to click through adding each CIDR individually in the WebUI. Thanks!