<html>
<body>
Victor,
<br>
<br>
What makes this tool or method better than the other tools out there? Just curious.
<br>
<br>
Thanks.
<br>
<br>
Leonard
<br>
<br>
<font color="#000000">> On Jul 10, 2018, at 8:28 AM, Victor Julien <<a href="mailto:lists@inliniac.net">lists@inliniac.net</a>> wrote:
</font><br>
<font color="#000000">>
</font><br>
<font color="#000000">> We recommend suricata-update:
</font><br>
<font color="#000000">>
</font><br>
<font color="#000000">> <a href="http://suricata-update.readthedocs.io/en/latest/update.html#modifying-rules">http://suricata-update.readthedocs.io/en/latest/update.html#modifying-rules</a>
</font><br>
<font color="#000000">>
</font><br>
<font color="#000000">> and
</font><br>
<font color="#000000">>
</font><br>
<font color="#000000">> <a href="http://suricata-update.readthedocs.io/en/latest/update.html#example-configuration-to-convert-rules-to-drop-drop-conf">http://suricata-update.readthedocs.io/en/latest/update.html#example-configuration-to-convert-rules-to-drop-drop-conf</a>
</font><br>
<font color="#000000">>
</font><br>
<font color="#000000">>> On 10-07-18 14:48, Leonard wrote:
</font><br>
<font color="#000000">>> You want to use one of signature management tools that can automatically
</font><br>
<font color="#000000">>> manage the signatures that can set the actions you want. See the
</font><br>
<font color="#000000">>> Suricata docs.
</font><br>
<font color="#000000">>>
</font><br>
<font color="#000000">>> On Jul 10, 2018, at 7:31 AM, <a href="mailto:gatodiablo@protonmail.com">gatodiablo@protonmail.com</a>
</font><br>
<font color="#000000">>> <mailto:<a href="mailto:gatodiablo@protonmail.com">gatodiablo@protonmail.com</a>> wrote:
</font><br>
<font color="#000000">>>
</font><br>
<font color="#000000">>>> Ok. It's easy enough to use sed to change the alerts to drops, but
</font><br>
<font color="#000000">>>> what about the next time updated rules are downloaded? I would have to
</font><br>
<font color="#000000">>>> change them again. I use emerging threat rules and they all appear to
</font><br>
<font color="#000000">>>> be alert only. Surely there is an simpler way to solve this?
</font><br>
<font color="#000000">>>>
</font><br>
<font color="#000000">>>>
</font><br>
<font color="#000000">>>> Sent from ProtonMail mobile
</font><br>
<font color="#000000">>>>
</font><br>
<font color="#000000">>>>
</font><br>
<font color="#000000">>>>
</font><br>
<font color="#000000">>>> -------- Original Message --------
</font><br>
<font color="#000000">>>> On Jul 9, 2018, 1:08 PM, Andreas Herz < <a href="mailto:andi@geekosphere.org">andi@geekosphere.org</a>
</font><br>
<font color="#000000">>>> <mailto:<a href="mailto:andi@geekosphere.org">andi@geekosphere.org</a>>> wrote:
</font><br>
<font color="#000000">>>>
</font><br>
<font color="#000000">>>>
</font><br>
<font color="#000000">>>> On 08/07/18 at 21:58, <a href="mailto:gatodiablo@protonmail.com">gatodiablo@protonmail.com</a>
</font><br>
<font color="#000000">>>> <mailto:<a href="mailto:gatodiablo@protonmail.com">gatodiablo@protonmail.com</a>> wrote:
</font><br>
<font color="#000000">>>>> Alert I think. Do I need a different set of rules to run in IPS
</font><br>
<font color="#000000">>>> mode? I ideally want it to both alert and drop anything that
</font><br>
<font color="#000000">>>> matches a rule.
</font><br>
<font color="#000000">>>>
</font><br>
<font color="#000000">>>> Yes you need to change the action keyword from 'alert' to 'drop' or it
</font><br>
<font color="#000000">>>> won't be dropped/blocked. You will still get an "alert" message as
</font><br>
<font color="#000000">>>> well
</font><br>
<font color="#000000">>>> which also mentiones the drop.
</font><br>
<font color="#000000">>>>
</font><br>
<font color="#000000">>>> --
</font><br>
<font color="#000000">>>> Andreas Herz
</font><br>
<font color="#000000">>>> _______________________________________________
</font><br>
<font color="#000000">>>> Suricata IDS Users mailing list:
</font><br>
<font color="#000000">>>> <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a>
</font><br>
<font color="#000000">>>> <mailto:<a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a>>
</font><br>
<font color="#000000">>>> Site: <a href="http://suricata-ids.org">http://suricata-ids.org</a> | Support:
</font><br>
<font color="#000000">>>> <a href="http://suricata-ids.org/support/">http://suricata-ids.org/support/</a>
</font><br>
<font color="#000000">>>> List:
</font><br>
<font color="#000000">>>> <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a>
</font><br>
<font color="#000000">>>>
</font><br>
<font color="#000000">>>> Conference: <a href="https://suricon.net">https://suricon.net</a>
</font><br>
<font color="#000000">>>> Trainings: <a href="https://suricata-ids.org/training/">https://suricata-ids.org/training/</a>
</font><br>
<font color="#000000">>>> _______________________________________________
</font><br>
<font color="#000000">>>> Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a>
</font><br>
<font color="#000000">>>> <mailto:<a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a>>
</font><br>
<font color="#000000">>>> Site: <a href="http://suricata-ids.org">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/">http://suricata-ids.org/support/</a>
</font><br>
<font color="#000000">>>> List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a>
</font><br>
<font color="#000000">>>>
</font><br>
<font color="#000000">>>> Conference: <a href="https://suricon.net">https://suricon.net</a>
</font><br>
<font color="#000000">>>> Trainings: <a href="https://suricata-ids.org/training/">https://suricata-ids.org/training/</a>
</font><br>
<font color="#000000">>>
</font><br>
<font color="#000000">>>
</font><br>
<font color="#000000">>> This email and any files transmitted with it are confidential and
</font><br>
<font color="#000000">>> intended solely for the use of the individual or entity to which they
</font><br>
<font color="#000000">>> are addressed. If you have received this email in error please notify
</font><br>
<font color="#000000">>> Netsecuris management at <a href="mailto:mgmt@netsecuris.com">mgmt@netsecuris.com</a>. Please note that any views
</font><br>
<font color="#000000">>> or opinions presented in this email are solely those of the author and
</font><br>
<font color="#000000">>> do not necessarily represent those of Netsecuris Inc. The integrity and
</font><br>
<font color="#000000">>> security of this message cannot be guaranteed on the Internet
</font><br>
<font color="#000000">>>
</font><br>
<font color="#000000">>>
</font><br>
<font color="#000000">>> _______________________________________________
</font><br>
<font color="#000000">>> Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a>
</font><br>
<font color="#000000">>> Site: <a href="http://suricata-ids.org">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/">http://suricata-ids.org/support/</a>
</font><br>
<font color="#000000">>> List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a>
</font><br>
<font color="#000000">>>
</font><br>
<font color="#000000">>> Conference: <a href="https://suricon.net">https://suricon.net</a>
</font><br>
<font color="#000000">>> Trainings: <a href="https://suricata-ids.org/training/">https://suricata-ids.org/training/</a>
</font><br>
<font color="#000000">>>
</font><br>
<font color="#000000">>
</font><br>
<font color="#000000">>
</font><br>
<font color="#000000">> --
</font><br>
<font color="#000000">> ---------------------------------------------
</font><br>
<font color="#000000">> Victor Julien
</font><br>
<font color="#000000">> <a href="http://www.inliniac.net/">http://www.inliniac.net/</a>
</font><br>
<font color="#000000">> PGP: <a href="http://www.inliniac.net/victorjulien.asc">http://www.inliniac.net/victorjulien.asc</a>
</font><br>
<font color="#000000">> ---------------------------------------------
</font><br>
<font color="#000000">>
</font><br>
<font color="#000000">> _______________________________________________
</font><br>
<font color="#000000">> Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a>
</font><br>
<font color="#000000">> Site: <a href="http://suricata-ids.org">http://suricata-ids.org</a> | Support: <a href="http://surica">http://surica</a></font><br>
ta-ids.org/support/
<br>
<font color="#000000">> List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a>
</font><br>
<font color="#000000">>
</font><br>
<font color="#000000">> Conference: <a href="https://suricon.net">https://suricon.net</a>
</font><br>
<font color="#000000">> Trainings: <a href="https://suricata-ids.org/training/">https://suricata-ids.org/training/</a>
</font><br>
<br>
<BR />
<BR />
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to which they
are addressed. If you have received this email in error please notify Netsecuris management at mgmt@netsecuris.com. Please note that any views or opinions presented in
this email are solely those of the author and do not necessarily
represent those of Netsecuris Inc. The integrity and
security of this message cannot be guaranteed on the Internet
<BR />
</body>
</html>