Bulk Tuning for 100+ Detections

[L-S-895]

Version

2.4.160

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

8

RAM

64gb

Storage for /

500GB

Storage for /nsm

3TB

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hello,

I am looking to apply the same tuning to a 100+ rules (TOR detections). I am unable to find a faster way then going into each individual detection and adding the same rule. This is quite time consuming, although possible, but I wanted to check there wasn't a faster way of doing this.

When i group select the rules I can only disable, enable or delete, no ability to tune multiple at the same time. I am suppressing each rule against a custom suricata variable.

Kind Regards,
LS

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

#14866

Issue created for this.