Disable Rule question and issue about scirius HOT 12 CLOSED

Yes - this is the only option - disable the rule as a whole (not per IP basis)
You have to apply the ruleset (after you disable that particular rule) - update/restart in the suricata submenu.

from scirius.

Pevma,
I understand this is the only option in Scirius, but isnt there an option with Suricata to disable rules based on SRC or DST IP address? as it is possible in Snort?
In snort, one just need to update the threshold.conf file (supress rule)
Looking at this article it seems it is also possible to do that in Suricata?
https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Global-Thresholds

Sorry if I am asking obvious questions, I am still very new to Suricata and starting to learn it... i.e. learning that it is using the same rules as Snort... so maybe the same threshold.conf file?

According to the article, Surricata uses a threshold.config file
http://www.aldeid.com/wiki/Suricata-vs-snort

The problem is that on SELKS 2.0, I can't find that file neither in /etc/suricata/rules
or /etc/suricata/rules/rules (why is there 2x "rules" folder!?)
Will try experimenting with this, but if there is indeed a way to "manually" suppress/disable rules based on SRC or DST IP then it would be great to have also an option in the SCIRIUS GUI.
This is a very powerful mechanism to tune our IDS rules with a bit more granularity.

I have heard from a work colleague that Snort is about to allow suppress with port numbers too in their next version. Again very useful especially with a very common false positive related to a TOR Exit alert which in fact is an NTP request to a NTP cluster node. Being able to filter on a rule to say ignore this alert from those local IP if they go on this port (53) is very granular and flexible.

Ok, I can just edit the original rule, but that's not the point :)
(I prefer to keep everything standard/default and just customise the threshold file)

from scirius.

Right, so I managed to suppress rules based on SRC or DST ip.
Realising that Suricata uses the same rules/files as snort makes this fairly easy.

Looking at /etc/suricata/suricata.yaml we can see that the default files for threshold is /etc/suricata/threshold.config

Then if you already have a snort threshold.conf file (i.e.: if you are running snort somewhere else on your network or Security Onion) it is just a matter of copying that file across and renaming it threshold.config.

The format for adding rules to that file can be found on many internet/google article related to snort.

A suggestion if I may, it would be nice to have a template or empty threshold.config file by default in /etc/suricata/threshold.config
I know, it is not that hard to look at the config file, but for newbies like me who don't really understand Suricata (starting to though!) it would make the transition from Snort or other NSM much smoother!

Last question... where does Scirius stores the rules it disables?!

from scirius.

You can not disable rules on a per by IP basis using Scirius but you can use that functionality as per standard Suricata feature (as you already did find :) ).
I think it is a nice suggestion (about the threshold.conf ) - although not really tough to come up by on your own.
The disabled rules are in the DB , not in /etc/suricata/rules/scirius.rules (thanks @regit ).

from scirius.

Doh! I didn't realise Scirius was storing those rules in a database!
Makes sense now, thanks!

from scirius.

Sorry... but that means Suricata also uses the database then right? So it knows not to alert on those rules?
Edit/PS: I am assuming Scirius can be used to manage Suricata and not just as a Suricata report tool

from scirius.

Suricata do no use the db. Interaction between Suri and scirius is just the scirius.rules file.

from scirius.

Ok, so I might be a bit slow here but...
If Scirius saves the Disabled Rules in its Database (/opt/selks/scirius/db/db.sqlite3
And Suricata does not access that database
Then it means disabling a rule in Scirius only removes it from the Scirius view and it does not really disable the rule for Suricata, meaning the rule will still be reported in the SELKS Dashboard.

If the above is right, then Scirius is not really a Suricata Management framework, but a reporting framework. Or maybe a bit of both :)

from scirius.

Suricata loads whatever rules are available in /etc/suricata/rules/scirius.rules. So if you disable a rule from Scirius - it will be removed from /etc/suricata/rules/scirius.rules and that way Suricata will not load it - hence disable it.

from scirius.

Doh!!! so that means because I deleted the disabled rules manually in the Scirius database, I have lost those 3 rules!
That was a stupid move :o/
Will try to find a way to restore the original scirius.rules

I was a bit too trigger happy today...

from scirius.

and thanks for the explanation, now I understand a bit better how this is all stitched together :)

from scirius.

This is fixed by 116e15f. Please reopen if needed.

from scirius.