Project

General

Profile

Actions
Copy link

Feature #2906

closed
KK KK

Make sure that noalert is set in newly enabled rules

Feature #2906: Make sure that noalert is set in newly enabled rules

Added by Konstantin Klinger about 7 years ago. Updated over 6 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Konstantin Klinger
Target version:
1.1.0rc1
Effort:
low
Difficulty:
low
Label:

Description

Suricata-update comes with the function that rules that depend on flowbits will get enabled recursively until all flowbit dependencies/conflicts are resolved. This leads to the following problem: Rules that have been previously disabled (e.g. in disable.conf) will get enabled and could produce a lot of noise (e.g. ET INFO rules that match on vulnerable Java versions). I would suggest to add the option "flowbit-no-alert" to enable flowbit dependencies "silently" and no alerts gets triggered for those rules.

VJ Updated by Victor Julien about 7 years ago Actions
Copy link
 #2

  • Description updated (diff)

JI Updated by Jason Ish about 7 years ago Actions
Copy link
 #3

I think its worth discussing if this should be the default behaviour rather than a flag. I had meant to do this in the initial version, and either forgot, or thought I did it already (which I obviously have not).

KK Updated by Konstantin Klinger about 7 years ago Actions
Copy link
 #4

Jason Ish wrote:

I think its worth discussing if this should be the default behaviour rather than a flag. I had meant to do this in the initial version, and either forgot, or thought I did it already (which I obviously have not).

Yes, I would vote for default behavior. But it is also worth a discussion, because in this way we are "manipulating" the original rule in some way by adding "flowbits:noalert;".

VJ Updated by Victor Julien about 7 years ago Actions
Copy link
 #5

Yeah, I feel this is sensible default as well.

KK Updated by Konstantin Klinger about 7 years ago Actions
Copy link
 #6

Shall I include this as default behavior in the pull request?

JI Updated by Jason Ish about 7 years ago Actions
Copy link
 #7

Konstantin Klinger wrote:

Shall I include this as default behavior in the pull request?

Yes please. I'm wondering if there should be an option to turn this off? My feeling right now is no, just make it work this way.

KK Updated by Konstantin Klinger about 7 years ago Actions
Copy link
 #8

I've adjusted my commit with the changes discussed and opened a new pull request: https://github.com/OISF/suricata-update/pull/140/

SB Updated by Shivani Bhardwaj almost 7 years ago Actions
Copy link
 #9

  • Status changed from New to Feedback

KK Updated by Konstantin Klinger almost 7 years ago Actions
Copy link
 #10

What do you think about doing the same thing for "xbits"? I am thinking about a resolve_xbits function and also enable depending rules silently with "noalert;".

SB Updated by Shivani Bhardwaj over 6 years ago Actions
Copy link
 #11

  • Status changed from Feedback to Resolved

SB Updated by Shivani Bhardwaj over 6 years ago Actions
Copy link
 #12

  • Status changed from Resolved to Closed

JI Updated by Jason Ish over 6 years ago Actions
Copy link
 #13

Konstantin Klinger wrote:

What do you think about doing the same thing for "xbits"? I am thinking about a resolve_xbits function and also enable depending rules silently with "noalert;".

Yes, we should consider the same for xbits.

JI Updated by Jason Ish over 6 years ago Actions
Copy link
 #14

  • Target version changed from TBD to 1.1.0rc1
Actions
Copy link

Also available in: PDF Atom