mail at mare-system.de
Mon Oct 11 14:34:56 UTC 2010
>> Coming to think of it, maybe it should be supported? Certainly makes it
>> easier for people who like to split their conf file
> Adding an include was on my mental to-do list. The other thing, which
> we had discussed sometime back was having an include statement right
> inside the rule files. That way suricata.yaml could just reference
> something like master.rules, and that would then include further
> rulesets. I had a need for that at one time, but not anymore.
includes at least for the rules.conf would very handy, esp.
if one has to maintain many/different sensors.
i like and rely on the concept of having includes
i maintain a cluster of sensors infront of webservers
that have a globally shared threshould/rules.conf and
a localrules/localthresh.conf for sensor-specific
thats easier to maintain in the long term.
More information about the Oisf-users