[Oisf-users] Suricata-Update sslbl ruleset

[Edgmand, Craig]

Hello,

    As so many of the abuse.ch rules are included in the Emerging Threats open ruleset is there a reason to add these separate rulesets from abuse.ch directly?

Just wondering.

Craig





-----Original Message-----
From: Oisf-users <oisf-users-bounces at lists.openinfosecfoundation.org> On Behalf Of Konstantin Klinger
Sent: Friday, November 30, 2018 9:40 AM
To: oisf-users at lists.openinfosecfoundation.org
Subject: [Oisf-users] Suricata-Update sslbl ruleset

Hello,

regarding the latest discussion of error messages from Suricata-Update
1.0.0 I would like to ask if anyone knows when abuse[.]ch will fix their SSL-Blacklist ruleset? I am still getting a 503 when I try to fetch "https://sslbl[.]abuse[.]ch/blacklist/sslblacklist.rules.".

At the Sigdev training @SuriCon someone told me that the are working on a new ruleset and they want to use also new TLS keywords from Suricata.
Does anyone know more about that topic?

Thanks & Cheers,

Konstantin

--
Konstantin Klinger
Security Content Engineer
Threat Detection & Hunting (TDH)

konstantin.klinger at dcso.de

dcso.de
blog.dcso.de

PGP: 180D C5B3 3C68 5C9A FB58 6F33 400E 5A35 3307 8D46

DCSO Deutsche Cyber-Sicherheitsorganisation GmbH • EUREF-Campus 22 •
10829 Berlin, Germany
Geschäftsführer: Dr.-Ing. Gunnar Siebert, Sitz der Gesellschaft: Berlin, Amtsgericht Charlottenburg HRB 172382


-------- Forwarded Message --------
Subject: Re: [Oisf-users] Suricata-update 1.0.0 messages
Date: Mon, 26 Nov 2018 21:43:02 +0530
From: Shivani Bhardwaj <shivanib134 at gmail.com>
To: r.fulton at auckland.ac.nz
CC: oisf-users at lists.openinfosecfoundation.org

Hello!

On Mon, Nov 12, 2018 at 7:19 AM Russell Fulton <r.fulton at auckland.ac.nz>
wrote:
>
>
> I get the following warnings from suricata-update:
>
> 12/11/2018 -- 14:41:46 - <Info> -- Checking https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsslbl.abuse.ch%2Fblacklist%2Fsslblacklist.rules.md5&data=02%7C01%7Ccraig.edgmand%40okstate.edu%7C20838cb977bc4400177208d656da327a%7C2a69c91de8494e34a230cdf8b27e1964%7C0%7C0%7C636791892491759340&sdata=7T2%2B6Yf84ECz6CwfXwoG53NQgumsJYS%2BufB0gvlhTM0%3D&reserved=0.
> 12/11/2018 -- 14:41:48 - <Warning> -- Failed to check remote checksum: 
> HTTP Error 503: Connection timed out
> 12/11/2018 -- 14:41:48 - <Info> -- Fetching https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsslbl.abuse.ch%2Fblacklist%2Fsslblacklist.rules&data=02%7C01%7Ccraig.edgmand%40okstate.edu%7C20838cb977bc4400177208d656da327a%7C2a69c91de8494e34a230cdf8b27e1964%7C0%7C0%7C636791892491759340&sdata=ouZFLX1C7NXcMVMoRBWsGtM5j8lhdNWJ%2BKCZ61cOz2w%3D&reserved=0.
> 12/11/2018 -- 14:41:50 - <Warning> -- Failed to fetch 
> https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsslbl.abuse.ch%2Fblacklist%2Fsslblacklist.rules&data=02%7C01%7Ccraig.edgmand%40okstate.edu%7C20838cb977bc4400177208d656da327a%7C2a69c91de8494e34a230cdf8b27e1964%7C0%7C0%7C636791892491759340&sdata=ouZFLX1C7NXcMVMoRBWsGtM5j8lhdNWJ%2BKCZ61cOz2w%3D&reserved=0, will use latest cached version: HTTP Error 503: Connection timed out …….
> 12/11/2018 -- 14:41:50 - <Info> -- Loading local file 
> /var/lib/suricata/rules/local.rules
> 12/11/2018 -- 14:41:50 - <Warning> -- No distribution rule directory found.