<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>There are at least two other ways of which I'm aware you can use
for rule management (full disclosure, I wrote one of them):</p>
<p>Scirius (Scirius Community Edition is a web interface dedicated
to Suricata ruleset management.
It handles the rules file and update associated files.):<br>
</p>
<p><a class="moz-txt-link-freetext" href="https://github.com/StamusNetworks/scirius">https://github.com/StamusNetworks/scirius</a></p>
<p>Mob-Boss (Github centric no frills rule management especially for
clustered environments):<br>
</p>
<p><a class="moz-txt-link-freetext" href="https://github.com/codeweaver33/mob-boss">https://github.com/codeweaver33/mob-boss</a><br>
</p>
<p><br>
</p>
<div class="moz-signature"><b>Dillon Bogenreif</b><br>
University Information Security<br>
University of Minnesota<br>
<a class="moz-txt-link-abbreviated" href="mailto:dbogenre@umn.edu">dbogenre@umn.edu</a><br>
612-624-5762 (office)<br>
GWAPT, GPEN</div>
<div class="moz-cite-prefix">On 10/25/2017 02:52 PM, dev wrote:<br>
</div>
<blockquote type="cite"
cite="mid:2cd62767-a7ca-1c6d-2a04-8be7595151ed@gmail.com">
<pre wrap="">Hi,
I usually update my rules with oinkmaster. I am getting errors[1] today
becuase the "disablesid" lines in oinkmaster.conf are no longer in the
downloaded ruleset. I don't think Oinkmaster is a suricata project
so I will forego asking about that here and rather ask:
What is the best way to stay current to update rules for suricata ?
Thanks
[1]
# oinkmaster -vC /etc/oinkmaster.conf -o /etc/suricata/rules
...
Processing downloaded rules...
disablesid 11, enablesid 0, modifysid 0, localsid 0, total rules 24093
WARNING: attempt to use "disablesid" on non-existent SID 2522828
...
WARNING: attempt to use "disablesid" on non-existent SID 2523106
WARNING: attempt to use "disablesid" on non-existent SID 2522234
_______________________________________________
Suricata IDS Users mailing list: <a class="moz-txt-link-abbreviated" href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a>
Site: <a class="moz-txt-link-freetext" href="http://suricata-ids.org">http://suricata-ids.org</a> | Support: <a class="moz-txt-link-freetext" href="http://suricata-ids.org/support/">http://suricata-ids.org/support/</a>
List: <a class="moz-txt-link-freetext" href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a>
Conference: <a class="moz-txt-link-freetext" href="https://suricon.net">https://suricon.net</a>
Trainings: <a class="moz-txt-link-freetext" href="https://suricata-ids.org/training/">https://suricata-ids.org/training/</a></pre>
</blockquote>
<br>
</body>
</html>