disableRegex seemingly not working #13698
-
Version2.4.100 Installation MethodSecurity Onion ISO image Descriptionconfiguration Installation TypeDistributed Locationon-prem with Internet access Hardware SpecsMeets minimum requirements CPU8 RAM64g Storage for /80g Storage for /nsm2T Network Traffic Collectiontap Network Traffic Speedsmore than 10Gbps StatusYes, all services on all nodes are running OK Salt StatusNo, there are no failures LogsNo, there are no additional clues DetailI have ET.PHISHING. added soc > config > server > modules > suricataengine > disableRegex However, it seems the rules aren't getting commented out? From one of our sensors: egrep '^alert.*ET PHISH' /opt/so/conf/suricata/rules/all.rules | wc -l Did I miss a step? Guidelines
|
Beta Was this translation helpful? Give feedback.
Replies: 2 comments 3 replies
-
|
Have you tried using the regex syntax shown at https://docs.securityonion.net/en/2.4/nids.html#enabling-and-disabling-with-regex? |
Beta Was this translation helpful? Give feedback.
-
|
Yes, added this: ET PHISHING\s but still: % egrep '^alert.*ET PHISH' /opt/so/conf/suricata/rules/all.rules | wc -l on one of our sensors |
Beta Was this translation helpful? Give feedback.
-
|
@jimhranicky Have you seen alerts from these rules? |
Beta Was this translation helpful? Give feedback.
-
|
I'm primarily trying to reduce load on the suricata engine - does the disableregex only suppress alerts, or is it supposed to disable the rules entirely? |
Beta Was this translation helpful? Give feedback.
-
|
It disables them entirely. For rules with flowbit dependencies, they are still enabled but set to |
Beta Was this translation helpful? Give feedback.
It disables them entirely. For rules with flowbit dependencies, they are still enabled but set to
noalert. Those are the rules you are seeing.