<HTML><BODY><div>Yes, I tried. But row order (disable-conf, enable-conf) in update.yaml didn’t affect.<br>
<br>
<blockquote style="border-left:1px solid #0857A6; margin:10px; padding:0 0 0 10px;">Суббота, 15 июня 2019, 9:53 +03:00 от Konstantin Klinger <konstantin.klinger@dcso.de>:<br>
<div id="">
<div class="js-helper js-readmsg-msg">
<style type="text/css">
</style>
<div>
<div id="style_15605816121958079554_BODY">
<div class="class_1560674926">Hi KK,
<div> </div>
<div>Have you tried to put the path of your .conf files into the update.yaml? Suricata-Update should parse and use ist then. The default path is /etc/suricata/.</div>
<div> </div>
<div>Cheers,</div>
<div>Konstantin <br>
<div dir="ltr" id="AppleMailSignature_mailru_css_attribute_postfix"><span style="background-color: rgba(255, 255, 255, 0);">-- <br>
Konstantin Klinger<br>
Security Content Engineer<br>
Threat Detection & Hunting (TDH)<br>
<br>
<a dir="ltr" rel=" noopener noreferrer" target="_blank" x-apple-data-detectors="true" x-apple-data-detectors-result="1" x-apple-data-detectors-type="telephone">+49 160 95476260</a><br>
<a dir="ltr" href="//octavius.mail.ru/compose/?mailto=mailto%3akonstantin.klinger@dcso.de" rel=" noopener noreferrer" target="_blank" x-apple-data-detectors="true" x-apple-data-detectors-result="2" x-apple-data-detectors-type="link">konstantin.klinger@dcso.de</a><br>
<br>
<a dir="ltr" href="http://dcso.de/" rel=" noopener noreferrer" target="_blank" x-apple-data-detectors="true" x-apple-data-detectors-result="3" x-apple-data-detectors-type="link">dcso.de</a><br>
<a dir="ltr" href="http://blog.dcso.de/" rel=" noopener noreferrer" target="_blank" x-apple-data-detectors="true" x-apple-data-detectors-result="4" x-apple-data-detectors-type="link">blog.dcso.de</a><br>
<br>
PGP: 180D C5B3 3C68 5C9A FB58 6F33 400E 5A35 3307 8D46<br>
<br>
DCSO Deutsche Cyber-Sicherheitsorganisation GmbH • EUREF-Campus<br>
22 • 10829 Berlin, Germany<br>
Geschäftsführer: Dr.-Ing. Gunnar Siebert, Sitz der Gesellschaft: Berlin,<br>
Amtsgericht Charlottenburg HRB 172382</span></div>
<div dir="ltr"><br>
Am 15.06.2019 um 07:44 schrieb K K <<a href="//octavius.mail.ru/compose/?mailto=mailto%3annex@mail.ru" rel=" noopener noreferrer" target="_blank">nnex@mail.ru</a>>:<br>
</div>
<blockquote type="cite">
<div dir="ltr">
<div>Hi, all!<br>
<br>
As I understand in suricata-update apply disable.conf after enable.conf. How can I change this behavior?<br>
I want to enable rules by regexp and make several exclude.<br>
<br>
Thx</div>
<div> </div>
<div data-signature-widget="container">
<div data-signature-widget="content">
<div>--<br>
K K</div>
</div>
</div>
</div>
</blockquote>
<blockquote type="cite">
<div dir="ltr"><span>_______________________________________________</span><br>
<span>Suricata IDS Users mailing list: <a href="//octavius.mail.ru/compose/?mailto=mailto%3aoisf%2dusers@openinfosecfoundation.org" rel=" noopener noreferrer" target="_blank"> oisf-users@openinfosecfoundation.org</a></span><br>
<span>Site: <a href="http://suricata-ids.org" rel=" noopener noreferrer" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" rel=" noopener noreferrer" target="_blank">http://suricata-ids.org/support/</a></span><br>
<span>List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" rel=" noopener noreferrer" target="_blank"> https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a></span><br>
<br>
<span>Conference: <a href="https://suricon.net" rel=" noopener noreferrer" target="_blank">https://suricon.net</a></span><br>
<span>Trainings: <a href="https://suricata-ids.org/training/" rel=" noopener noreferrer" target="_blank">https://suricata-ids.org/training/</a></span></div>
</blockquote>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
<div> </div>
<div data-signature-widget="container">
<div data-signature-widget="content">
<div>--<br>
K K</div>
</div>
</div>
<div> </div>
</div>
</BODY></HTML>