Suricata binary

[DashCarlos]

Where is the binary file of Suricata in SecurityOnion 2.3?
I need to know its location to adapt the suricata-update command

[dougburks]

Is there any particular reason you need suricata-update? We already include a method for updating your Suricata rules:
https://docs.securityonion.net/en/2.3/rules.html?highlight=%22so-rule-update%22#updating-rules

[DashCarlos]

Is there any particular reason you need suricata-update? We already include a method for updating your Suricata rules:
https://docs.securityonion.net/en/2.3/rules.html?highlight=%22so-rule-update%22#updating-rules

When I try to add a file with my rules (+70000) it doesn't recognize the parameter, it just updates with ETOpen by default, so I think "so-rule-update" doesn't accept parameters, so I thought it would be a good idea to adapt "suricata-update".
Is there an easier solution?

Example of what happens:

[ariadnex@arisec ~]$ sudo so-rule-update --local '/tmp/archivo.rules'
[sudo] password for ariadnex:
2020-11-17 11:06:10,409 - - Loading ./rulecat.conf.
2020-11-17 11:06:10,416 - - Forcing Suricata version to 5.0.
2020-11-17 11:06:10,417 - - Last download less than 15 minutes ago. Not downloading https://rules.emergingthreats.net/open/suricata-5.0.0/emerging.rules.tar.gz.
2020-11-17 11:06:10,625 - - Ignoring file rules/emerging-deleted.rules
2020-11-17 11:06:10,626 - - Loading local file /opt/so/rules/nids/local.rules
2020-11-17 11:06:16,937 - - Loaded 28100 rules.
2020-11-17 11:06:16,963 - - Disabled 0 rules.
2020-11-17 11:06:16,964 - - Enabled 0 rules.
2020-11-17 11:06:16,964 - - Modified 0 rules.
2020-11-17 11:06:16,964 - - Dropped 0 rules.
2020-11-17 11:06:17,625 - - Enabled 145 rules for flowbit dependencies.
2020-11-17 11:06:25,222 - - Writing rules to /opt/so/rules/nids/all.rules: total: 28100; enabled: 21029; added: 0; removed 0; modified: 0
2020-11-17 11:06:25,834 - - No changes detected, will not reload rules or run post-hooks

[dougburks]

Have you checked the documentation for adding local rules?
https://docs.securityonion.net/en/2.3/local-rules.html

[DashCarlos]

I'll take a look, I'm very interested