Project

General

Profile

Actions
Copy link

Support #2120

closed
RK

Disable rule-set emerging-chat.rules.

Support #2120: Disable rule-set emerging-chat.rules.

Added by Roman Karpyuk over 9 years ago. Updated over 7 years ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Affected Versions:
Label:

Description

Hi guys,
I have some stupid problem, I want to disable emerging-chat.rules. But when I comment line with this rule-set in suricata.yaml and reload suricata it doesn't help. I still see that rules(like Skype VOIP or Google Talk etc.) in SIEM. So how can I fix this what I have missed?

For managing rules, I use Oinkmaster.

Thanks.

Files

example (1.68 KB) example Roman Karpyuk, 05/31/2017 02:46 AM

AH Updated by Andreas Herz over 9 years ago Actions
Copy link
 #1

  • Assignee set to Anonymous
  • Priority changed from High to Normal
  • Target version set to Support

Can you provide us with more details? Especially the `rule-files` section of your config where you include the rules. This could also be an issue with your oinkmaster configuration.

RK Updated by Roman Karpyuk over 9 years ago Actions
Copy link
 #2

I think, that isn't problem with oinkmaster, because all another rules have been modified excellent.
What do you mean when say "rule-files section"? In suricata.yaml in section when we should add/disable rules, I have commented emerging-chat.rules for disable this rules. I've attached file with part of suricta.yaml config.
In oinkmaster.conf I only change priority for rules, like this - modifysid 2012648, ..., "classtype:" | "priority:3; classtype:".
So, problem is that I can't disable/switch off chat-rules.
I think maybe this rules have dependents with flowbits, but NO.

Thanks

AH Updated by Andreas Herz over 9 years ago Actions
Copy link
 #3

If you start suricata with "-vvv" what do you see in the "<Config> - Loading rule file:" outpout? is emerging-chat.rules shown? Then you need to check what oinkmaster is doing with your config. Something external seems to change your rule-files settings then.

VJ Updated by Victor Julien over 9 years ago Actions
Copy link
 #4

  • Subject changed from Disable rule-set emerging-char.rules. to Disable rule-set emerging-chat.rules.

VJ Updated by Victor Julien over 7 years ago Actions
Copy link
 #5

  • Status changed from New to Closed
  • Assignee deleted (Anonymous)
  • Target version deleted (Support)
Actions
Copy link

Also available in: PDF Atom