I notice lots of "critical" level alerts in suricata now.

[DebianGuru]

Version

2.4.70

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

20

RAM

18GB

Storage for /

166G

Storage for /nsm

3.4TB

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

I subscribe to the ETPRO rules. I noticed that under "Detections" now I see over 11,000 critical level rules written for Suricatat. If you put the following in the search, you'll see what I'm talking about. _id:* AND so_detection.severity: "critical" AND so_detection.isEnabled: "true" AND NOT so_detection.language:"sigma" | groupby so_detection.language | groupby so_detection.ruleset so_detection.isEnabled | table so_detection.title so_detection.isEnabled so_detection.severity so_detection.ruleset so_detection.language soc_timestamp

I've not seen this until today. I previously thought that Suricata had NO critical level alerts and that that level was only for sigma (playbook). Has something changed??? I did look at the SO blog and didn't see anything. Some googling about Suricata https://suricata.io/2024/02/08/suricata-7-0-3-and-6-0-16-released/ makes it sound as though something has changed with it, but I'm not sure if I'm reading that correctly. Any help is appreciated to help me understand why this has changed.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.