Can't disable default ruleset (ET Open, ET Pro, etc)

[arifandiwahyu]

Hello, i'd like to know is there a way to disable default ruleset like ET Open, ET Pro, etc from security onion and only using my own remotely ruleset url and local rules?
I know i can add my own remotely url ruleset and local rules, but i want to DISABLE the default ruleset of ET Open or ET Pro on it.
I'm using Security Onion 2.3.190

[dougburks]

I haven't tested this, but you might be able to set ruleset to null or '' in /opt/so/saltstack/local/pillar/minions/<manager.sls>:
https://docs.securityonion.net/en/2.3/rules.html

If you can't get that to work, then another option might be to leave the ETOPEN ruleset enabled but disable all of its rules via regex:
https://docs.securityonion.net/en/2.3/managing-alerts.html#disable-the-sid