<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif;">Hi, </div><div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif;"><br></div><div style="widows: 1;"><font face="Calibri,sans-serif">I am trying to update rules (Live rule swap) without shutting off the suricata engine. I am tried to run this </font><span style="background-color: rgb(250, 250, 250); widows: 1;"><font color="#484848" face="Calibri,sans-serif">root@LTS-64-1:~ # kill -USR2 ID, but it seems that nothing happened. I didn’t not receive a notification regarding </font></span><span style="background-color: rgb(250, 250, 250);"><font color="#484848">rule reload. Will you please help me what I might be missing.</font></span></div><div style="widows: 1;"><span style="background-color: rgb(250, 250, 250);"><font color="#484848"><br></font></span></div><div style="widows: 1;"><font color="#484848"><span style="background-color: rgb(248, 248, 248);">Thanks</span></font></div><div style="widows: 1;"><font color="#484848"><span style="background-color: rgb(246, 246, 246);">Samiksha</span></font></div><div style="widows: 1;"><font color="#484848"><span style="font-size: 12px; background-color: rgb(246, 246, 246);"><br></span></font></div><div style="widows: 1;"><span style="background-color: rgb(250, 250, 250); widows: 1;"><font color="#484848" face="Calibri,sans-serif"><span style="font-size: 12px;"><br></span></font></span></div><div style="widows: 1;"><span style="background-color: rgb(250, 250, 250); widows: 1;"><font color="#484848" face="Calibri,sans-serif"><span style="font-size: 12px;"><br></span></font></span></div><div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;"><br></div><span id="OLK_SRC_BODY_SECTION" style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;"><div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt"><span style="font-weight:bold">From: </span> <Saxena>, Samiksha <<a href="mailto:samiksha.saxena@verizon.com">samiksha.saxena@verizon.com</a>><br><span style="font-weight:bold">Date: </span> Thursday, July 16, 2015 at 1:59 PM<br><span style="font-weight:bold">To: </span> Brandon Lattin <<a href="mailto:latt0050@umn.edu">latt0050@umn.edu</a>>, oisf-users <<a href="mailto:oisf-users@lists.openinfosecfoundation.org">oisf-users@lists.openinfosecfoundation.org</a>><br><span style="font-weight:bold">Subject: </span> Re: [Oisf-users] Suricata rule deployment<br></div><div><br></div><div><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;"><div>This sounds interesting. Please let us know when you have a public release of this application. </div><div><br></div><span id="OLK_SRC_BODY_SECTION"><div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt"><span style="font-weight:bold">From: </span>Brandon Lattin <<a href="mailto:latt0050@umn.edu">latt0050@umn.edu</a>><br><span style="font-weight:bold">Date: </span>Thursday, July 16, 2015 at 1:53 PM<br><span style="font-weight:bold">To: </span>oisf-users <<a href="mailto:oisf-users@lists.openinfosecfoundation.org">oisf-users@lists.openinfosecfoundation.org</a>><br><span style="font-weight:bold">Subject: </span>Re: [Oisf-users] Suricata rule deployment<br></div><div><br></div><div dir="ltr">We wrote a replacement for oinkmaster/pulledpork that's intended for highly tuned rulesets and multiple sensors. We were planning on releasing it to the public, but have been caught up with a million other projects recently.
<div><br></div><div>It generates the rule files (all.rules, .map files, etc), a rule state config, and some additional reports, which are all pushed to a local github repo that is pulled by all sensors on Suricata restart. It's probably not worth all the hassle if you're
a smaller shop, but if you're managing a large number of sensors, it may prove useful.</div><div><br></div><div>I'll chat with the lead developer and try and bump up the public release to the near future.</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Jul 16, 2015 at 12:42 PM, Alan Wanderley dos Santos
<span dir="ltr"><<a href="mailto:alan.santos@rnp.br" target="_blank">alan.santos@rnp.br</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div style="font-family:Andale Mono;font-size:12pt;color:#000000"><div>Hi,</div><div><br></div><div>Yes, its possibel. There are a lot of emails about puppet in olders mails from this list.<br></div><div><br></div><div>On our environment, we use scripts (on each suricata instance) to get all rules from a master server. The master servers is manually updated. In this case, i don't think that puppet is necessary because we update (manually) just the master.</div><div><br></div><div>The Master have a apache server that allow download of rules (.tar.gz file). The script on each suricata instance (we call it of engine), get the file using curl. The script untar the file, install the rules e restart suricata service.</div><div><br></div><div>But, we develop this way for supply our own requirement. Maybe, in your case, puppet is enough(?).</div><span class=""><div><br></div><div>Best Regards,</div><div><br></div><div>-----------------------------------------------<br></div><div>Alan Santos<br>
Analista de Segurança<br>
Centro de Atendimento a Incidentes de Segurança (CAIS)<br>
Rede Nacional de Ensino e Pesquisa (RNP)<br>
(19) 3787-3314 | <a href="mailto:alan.santos@rnp.br" target="_blank">alan.santos@rnp.br</a></div><br><hr></span><div><span class=""><b>De: </b>"Saxena, Samiksha" <<a href="mailto:samiksha.saxena@verizon.com" target="_blank">samiksha.saxena@verizon.com</a>><br></span><b>Para: </b>"Alan Wanderley dos Santos" <<a href="mailto:alan.santos@rnp.br" target="_blank">alan.santos@rnp.br</a>><br><b>Cc: </b><a href="mailto:oisf-users@lists.openinfosecfoundation.org" target="_blank">oisf-users@lists.openinfosecfoundation.org</a><br><b>Enviadas: </b>Quinta-feira, 16 de julho de 2015 14:23:11<br><b>Assunto: </b>Re: [Oisf-users] Suricata rule deployment<br></div><div><div class="h5"><br><div><div>Can I use puppet/ansible to install rules on central server and then push it with an script or just copy the rules on each suricata instance?</div><br><br><span><div style="font-family:Calibri;font-size:11pt;text-align:left;color:black;border-bottom:medium none;border-left:medium none;border-top:#b5c4df 1pt solid;border-right:medium none;padding:3pt 0in 0in 0in"><span style="font-weight:bold">From: </span>Alan Wanderley dos Santos <<a href="mailto:alan.santos@rnp.br" target="_blank">alan.santos@rnp.br</a>><br><span style="font-weight:bold">Date: </span>Tuesday, July 14, 2015 at 8:35 AM<br><span style="font-weight:bold">To: </span>"Saxena, Samiksha" <<a href="mailto:samiksha.saxena@one.verizon.com" target="_blank">samiksha.saxena@one.verizon.com</a>><br><span style="font-weight:bold">Cc: </span>"<a href="mailto:oisf-users@lists.openinfosecfoundation.org" target="_blank">oisf-users@lists.openinfosecfoundation.org</a>" <<a href="mailto:oisf-users@lists.openinfosecfoundation.org" target="_blank">oisf-users@lists.openinfosecfoundation.org</a>><br><span style="font-weight:bold">Subject: </span>Re: [Oisf-users] Suricata rule deployment<br></div><br><div><div><div style="font-family:Andale Mono;font-size:12pt;color:#000000"><div>Hi,</div><br><div>I did a master server with a web gui interface. So, is possible deploy rules updates (.tar.gz files) on this web gui. The engines have a shell script that download and deploy on each suricata instance. We chose do that way because some reasons:</div><br><div>* We have some particulars rules and there are rules with "false positive" (i don't know with this is the better word).
</div><div>* Make the deploy process user-friendly.</div><div>* We don't have control on suricata instances. Each admin have control (user-level) on your own instance.</div><br><div>Sorry for my english mistakes.</div><br><div>Best Regards,</div><br><div>-----------------------------------------------<br>
Alan Santos<br>
Analista de Segurança<br>
Centro de Atendimento a Incidentes de Segurança (CAIS)<br>
Rede Nacional de Ensino e Pesquisa (RNP)<br>
(19) 3787-3314 | <a href="mailto:alan.santos@rnp.br" target="_blank">alan.santos@rnp.br</a></div><br><hr><div><b>De: </b>"Saxena, Samiksha" <<a href="mailto:samiksha.saxena@verizon.com" target="_blank">samiksha.saxena@verizon.com</a>><br><b>Para: </b>"<a href="mailto:oisf-users@lists.openinfosecfoundation.org" target="_blank">oisf-users@lists.openinfosecfoundation.org</a>" <<a href="mailto:oisf-users@lists.openinfosecfoundation.org" target="_blank">oisf-users@lists.openinfosecfoundation.org</a>><br><b>Enviadas: </b>Sexta-feira, 10 de julho de 2015 17:06:04<br><b>Assunto: </b>[Oisf-users] Suricata rule deployment<br></div><br><div><div>Hi, </div><br><div>I have a question about Suricata rules push. I am thinking to use Okinmaster to install rules. Is there a way to have a centrailzed server to install all the rules and distribute to all the suricata instances?</div><br><div>Thanks</div><br>
_______________________________________________<br>
Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank">
oisf-users@openinfosecfoundation.org</a><br>
Site: <a href="http://suricata-ids.org" target="_blank">http://suricata-ids.org</a> | Support:
<a href="http://suricata-ids.org/support/" target="_blank">http://suricata-ids.org/support/</a><br>
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">
https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>Suricata User Conference November 4 & 5 in Barcelona: <a href="http://oisfevents.net" target="_blank">
http://oisfevents.net</a></div></div></div></div></span><br></div></div></div></div></div><br>
_______________________________________________<br>
Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">
oisf-users@openinfosecfoundation.org</a><br>
Site: <a href="http://suricata-ids.org" rel="noreferrer" target="_blank">http://suricata-ids.org</a> | Support:
<a href="http://suricata-ids.org/support/" rel="noreferrer" target="_blank">http://suricata-ids.org/support/</a><br>
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" rel="noreferrer" target="_blank">
https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>Suricata User Conference November 4 & 5 in Barcelona: <a href="http://oisfevents.net" rel="noreferrer" target="_blank">
http://oisfevents.net</a><br></blockquote></div><br><br clear="all"><div><br></div>
-- <br><div class="gmail_signature"><div dir="ltr">Brandon Lattin
<div>Security Analyst<br><div>University of Minnesota - University Information Security<br>
Office: 612-626-6672</div></div></div></div></div></span></div></div></span></body></html>