Security Onion 2.3.21 No all.rules file in salt for Suricata, Suricata not generating any alerts.

[w4rc0n]

I don't have any file called: /opt/so/rules/nids/all.rules
I only have: /opt/so/rules/nids/local.rules

Thusly, Suricata is not generating any alerts, since it has no rules.

Any advice on getting those in place? I selected ETOPEN during the manager node setup, but it doesn't seem to have pulled any rules.

I think it might be related to me using a proxy. Using so-rule-update seems to fail, timing out on fetching rules. In the old version of SO, you had to add a line in the SO config to add the -W option to pulled pork, in order for it to work via proxy. Is there something like that going on here?

[TOoSmOotH]

I put in #2587 do take a look at this. It is a proxy issue. Current work around is a proxy exception. idstools does not have a proxy option so we will need to sneak an environment variable in there.

[w4rc0n]

Thank you! I'll go no proxy for the time being.