<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>The command line option might work. Is there a limit how long the variable can be when passed with command line option?<br><br>Or maybe there is another solution to my original problem. This variable contains a list of IPs. My goal is to avoid any alerts for these IPs since they get blocked completely by something else but Suricata still sees this traffic. So I've created a variable and set my external net to be !home_net and !myvariable. This way traffic from these IPs is treated as home traffic and no alerts get triggered.<br><br>If there is another way of doing this exclusion, I am welcome to suggestions.<br><br>Thanks Jason.<br><br><div>> Date: Tue, 24 Jun 2014 09:44:52 -0600<br>> Subject: Re: [Oisf-users] Include a file in configuration<br>> From: lists@unx.ca<br>> To: coolyasha@hotmail.com<br>> CC: oisf-users@lists.openinfosecfoundation.org<br>> <br>> On Mon, Jun 23, 2014 at 10:21 AM, Yasha Zislin <coolyasha@hotmail.com> wrote:<br>> > I am trying to figure out if there is a way to include a separate file in<br>> > configuration for Suricata.<br>> > Specifically I want to include a variable (address-groups) which is stored<br>> > somewhere else.<br>> ><br>> > The goal is to allow non-admin user to modify this variable without touching<br>> > the main config file.<br>> <br>> Unfortunately what you want to do can't be accomplished with an<br>> include file at this time. It looks like you want to have a second<br>> config file that looks like:<br>> <br>> %YAML 1.1<br>> ---<br>> vars:<br>> address-groups:<br>> USER_VAR: "[10.1.2.3/32]"<br>> <br>> and have it merged into the address-groups in the main configuration<br>> file? At this time, subsequent nodes of the same name wipe out the<br>> previous one, so depending on where you put your include statement,<br>> you will end up with the vars section from the include file or the<br>> main file, but not a merge of them. YAML does have support for a<br>> merge, but its supported by Suricata at this time.<br>> <br>> Another option is to set a variable on the command line, for example:<br>> <br>> suricata -c suricata.yaml --set vars.address-groups.HOME_NET="[24.0.0.0/8]"<br>> <br>> this will override the HOME_NET setting in the configuration. Wrap<br>> this up in a script that pulls the value in from an external file?<br>> <br>> Hope that helps,<br>> Jason<br></div> </div></body>
</html>