telekom-security/tpotce
1
0
Fork 0
mirror of https://github.com/telekom-security/tpotce.git synced 2025-07-02 01:27:27 -04:00
Code Issues Packages Projects Releases Wiki Activity

Suricata: use suricata-update for rule management

Browse Source 
As a bonus we can now run "suricata-update" using docker-exec,
triggering both a rule update and a Suricata rule reload.
This commit is contained in:
Andrea De Pasquale
2020-11-26 18:10:16 +01:00
parent 2ecef8c607
commit 87a27e4f2b
9 changed files with 39 additions and 98 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
docker/suricata/dist/update.yaml vendored Normal file
View File

@ -0,0 +1,12 @@
disable-conf: /etc/suricata/disable.conf
enable-conf: /etc/suricata/enable.conf
#drop-conf: /etc/suricata/drop.conf
modify-conf: /etc/suricata/modify.conf
ignore:
- "*deleted.rules"
- "dhcp-events.rules" # DHCP is disabled in suricata.yaml
- "files.rules" # file-store is disabled in suricata.yaml
reload-command: suricatasc -c ruleset-reload-rules