Add custom rules to Detections

[tuamortemo]

Version

2.4.70

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

16-32

RAM

16-32

Storage for /

200gb

Storage for /nsm

1,7 TB

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hello,
I have several custom rulesets for suricata, which I added to the /opt/so/rules/nids/suri/ folder and registered them in /opt/so/saltstack/default/salt/idstools/etc/rulecat.conf as follows
--local=/opt/so/rules/nids/suri/local.rules
--local=/opt/so/rules/nids/suri/scan.rules
--local=/opt/so/rules/nids/suri/custom1.rules

But in SOC Detections menu i can't manage them. How do I make this possible?

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[TOoSmOotH]

You would want to add the actual rules to detections vs the files via the + button. We are looking at specifying additional rule locations in a future release.