Suricata » Suricata-Update

https://github.com/OISF/suricata-update/pull/128

I think its worth discussing if this should be the default behaviour rather than a flag. I had meant to do this in the initial version, and either forgot, or thought I did it already (which I obviously have not).

Jason Ish wrote:

I think its worth discussing if this should be the default behaviour rather than a flag. I had meant to do this in the initial version, and either forgot, or thought I did it already (which I obviously have not).

Yes, I would vote for default behavior. But it is also worth a discussion, because in this way we are "manipulating" the original rule in some way by adding "flowbits:noalert;".

Yeah, I feel this is sensible default as well.

Shall I include this as default behavior in the pull request?

Konstantin Klinger wrote:

Shall I include this as default behavior in the pull request?

Yes please. I'm wondering if there should be an option to turn this off? My feeling right now is no, just make it work this way.

I've adjusted my commit with the changes discussed and opened a new pull request: https://github.com/OISF/suricata-update/pull/140/

What do you think about doing the same thing for "xbits"? I am thinking about a resolve_xbits function and also enable depending rules silently with "noalert;".

Konstantin Klinger wrote:

What do you think about doing the same thing for "xbits"? I am thinking about a resolve_xbits function and also enable depending rules silently with "noalert;".

Yes, we should consider the same for xbits.