Monitor Intel feeds

[3isenHeiM]

Is there a feature where SecurityOnion will alert me if it couldn't connect and updates the signatures ?
Especially for custom industry-specific feeds, it's important to know if your detection rules are still up-to-date.

Thanks !

[InfosecGoon]

I believe the Suricata container restarts whenever new rules are loaded -- would a Grafana alert that fires when so-suricata is more than X hours of uptime be high-fidelity enough for this?

[3isenHeiM]

The only corner case I see here is if no updates is available, the container will fetch but not restart...

Anyway thanks for the hint it seems reasonable good enough.