For our last discussion in this section,
we're going to take a look at updating the rules that Suricata uses.
A common first question is where do I find rules?
Well, that really depends.
One of the most popular rulesets out there is from Emerging
Threats Proofpoint and it's their Open ruleset.
It's considered open since it is free to use in pretty much all settings.
In fact, most default installations of Suricata come preconfigured to use ETOpen.
Rulesets contain a series of individual rules.
Most of these rules are written by a human being,
and as such, only updated so often.
In the case of the Open set, that is typically once a day.
So it's a good practice to figure out when rulesets are updated,
and if it's regular enough, update no more frequent than that.
Updating when there are no changes to the rules does
not provide you with any value.
The recommended way to update and manage the rules is to use suricata‑update.
So let's talk a little bit more about that.
Suricata‑update is the default rule management tool and comes with
the most recent Suricata installation paths.
If there are new rules, it will go ahead and download them for you.
As you get more advanced with your rulesets,
you will also be able to use suricata‑update to automatically enable,
disable, and modify rules before telling Suricata to load them.
It will also test that the rules are valid,
but it doesn't guarantee that they will work as intended,
that's up to the rule writer.
Before it will finally write out a new file at
var/lib/suricata/rules/suricata.rules.
A very important note.
By default, suricata‑update will not tell Suricata to reload those new rules.
Suricata supports live rule reloading,
which means that you don't have to stop and restart the
engine to load your updated rules.
To accomplish this, you can use the command suricatasc ‑c reload‑rules.
Suricatasc is a utility to work with Suricata via UNIX sockets.
You may now be asking, that's great that we get ETOpen,
but how can I add other sources?
Well, I'm glad you asked.
Suricata‑update also allows you to configure the source
that checks the download rules from.
Sources can be added, removed, and even disabled.
As you configure the sources you want to use,
you can then run suricata‑update periodically to keep your Suricata
installation running the latest and greatest.
The simplest way of executing suricata‑update is to simply run
the suricata‑update command from a terminal.
Well, we'll cover many of the key features of suricata‑update,
we won't have time for all of them.
You can learn more about suricata‑update by running the command,
suricata‑update ‑h.
Now let's take a look at some of those key commands.
The first up is list‑sources.
List‑sources gives you a listing of all available
sources that suricata‑update knows about.
There is a default list, which comes from the Suricata intel index.
As you can see in the screenshot,
each source begins with the Name field and goes on to
provide information about the Vendor, License,
Summary, and Subscription.
Subscription will be required if the source is
offered under a commercial license,
and you'll have to contact that vendor in order to get more information.
While the default set of sources provides a good place to start,
you'll likely want to eventually customize your sources.
With the add‑source command, you can do just that.
The command is fairly straightforward.
You need to provide the name of the source and the location, such as the URL.
In this screenshot, you can see we are adding test‑source with a URL of abc.xyz.
After running this command, you can run list‑sources to confirm it was added,
then update to get those rules.
The next command is disable‑source.
This does what it sounds like,
it disables the source so that suricata‑update will not download from it.
It does, however, allow suricata‑update to keep track of it.
In this screenshot,
you can see that the argument needed for this command is the name of the source.
After running this command,
you can confirm it was disabled by running list enable‑sources.
You should not see the source you just disabled in this output.
The last command we'll discuss is update‑sources.
This simply updates the sources to their latest.
In the screenshot, you can see the use of the intel index as well.
And that's it for getting started with rules.
We've just begun to scratch the surface, and there's plenty more to come.
But for now, let's move on to our next demo and see suricata‑update in action.