Query regarding firewall in Security onion

[rohan0017]

I am trying to remove a rule from iptables i.e I want to drop all incoming ssh traffic, I am doing whitelisting on my server( no one should ssh my server)
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT

But this rule is getting added after sometime.

Is is there any script or process that is adding this rule.

[dougburks]

iptables is managed by Security Onion:
https://docs.securityonion.net/en/2.4/firewall.html#host-firewall