Project

General

Profile

Actions
Copy link

Support #3426

closed

Do rules need to change when moving on suricata5.0 ?

Added by Zhu Zhu over 4 years ago. Updated almost 4 years ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Affected Versions:
5.0.0
Label:
Beginner, Outreachy

Description

We are planning to move on 5.0 from 4.0.3 for some reason. The rules we use in 4.0.3 include ET rules and some customized rules, and they work well in the old version. Do ET and customized rules in 4.0.3 will also work in 5.0? We don't want to change our rules actually. If they work, that's will be good news for us.

Can someone help me out? Thanks.

Actions
Copy link
 #1

Updated by Andreas Herz over 4 years ago

  • Status changed from New to Feedback
  • Assignee set to Zhu Zhu

Unless you have very old rules with old deprecated keywords I don't expect any issues.
But the best way would be to use the officall 5.0.1 release and test it. If there are any issues with the rules you would get some warnings and can work on those to be fixed.

Actions
Copy link
 #2

Updated by Victor Julien almost 4 years ago

  • Status changed from Feedback to Closed
  • Assignee deleted (Zhu Zhu)
Actions
Copy link

Also available in: Atom PDF