<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div></div><div>You want to use one of signature management tools that can automatically manage the signatures that can set the actions you want. See the Suricata docs.</div><div><br>On Jul 10, 2018, at 7:31 AM, <a href="mailto:gatodiablo@protonmail.com">gatodiablo@protonmail.com</a> wrote:<br><br></div><blockquote type="cite"><div>Ok. It's easy enough to use sed to change the alerts to drops, but what about the next time updated rules are downloaded? I would have to change them again. I use emerging threat rules and they all appear to be alert only. Surely there is an simpler way to solve this?<br><br><br>Sent from ProtonMail mobile<br><br><br><br>-------- Original Message --------<br>On Jul 9, 2018, 1:08 PM, Andreas Herz < <a href="mailto:andi@geekosphere.org">andi@geekosphere.org</a>> wrote:<blockquote class="protonmail_quote"><br>On 08/07/18 at 21:58, <a href="mailto:gatodiablo@protonmail.com">gatodiablo@protonmail.com</a> wrote:<br>> Alert I think. Do I need a different set of rules to run in IPS mode? I ideally want it to both alert and drop anything that matches a rule.<br><br>Yes you need to change the action keyword from 'alert' to 'drop' or it<br>won't be dropped/blocked. You will still get an "alert" message as well<br>which also mentiones the drop.<br><br>-- <br>Andreas Herz<br>_______________________________________________<br>Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a><br>Site: <a href="http://suricata-ids.org">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org">http://suricata-ids.org</a>/support/<br>List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br><br>Conference: <a href="https://suricon.net">https://suricon.net</a><br>Trainings: <a href="https://suricata-ids.org/training/">https://suricata-ids.org/training/</a></blockquote></div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a></span><br><span>Site: <a href="http://suricata-ids.org">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/">http://suricata-ids.org/support/</a></span><br><span>List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a></span><br><span></span><br><span>Conference: <a href="https://suricon.net">https://suricon.net</a></span><br><span>Trainings: <a href="https://suricata-ids.org/training/">https://suricata-ids.org/training/</a></span></div></blockquote><BR />
<BR />
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to which they
are addressed. If you have received this email in error please notify Netsecuris management at mgmt@netsecuris.com. Please note that any views or opinions presented in
this email are solely those of the author and do not necessarily
represent those of Netsecuris Inc. The integrity and
security of this message cannot be guaranteed on the Internet
<BR />
</body></html>