Suricata

A signature with a threshold, e.g.:

alert tcp any any -> any 25 (msg:"ET POLICY Inbound Frequent Emails - Possible Spambot Inbound"; flow:established; content:"mail from|3a|"; nocase; threshold: type threshold, track by_src, count 10, seconds 60; reference:url,doc.emergingthreats.net/2002087; classtype:misc-activity; sid:2002087; rev:10;)

suppress gen_id 1, sig_id 2002087, track by_src, ip xx
suppress gen_id 0, sig_id 0, track by_src, ip xx
suppress gen_id 1, sig_id 0, track by_src, ip xx
suppress gen_id 1, sig_id 2002087

event_filter gen_id 1, sig_id 2002087, type limit, track by_src, count 1, seconds 3600

I've added support for suppressing thresholded sigs, but the other globals from threshold.config are not yet supported for sigs with a threshold.

Added support for overriding per signature thresholds.

commit 82fc61770bd3cdeb5cf033bfa8f7dc2580ebffbc
Author: Victor Julien <victor@inliniac.net>
Date:   Wed Sep 26 08:58:05 2012 +0200

    threshold: allow threshold.config to override rule

    Allow threshold.conf to override rule thresholds in the following
    cases:

    - threshold.config rule uses threshold or event_filter AND
    - threshold.config rule applies to a single signature (so no
      gid 0 or sid 0)

    Confirmed to work with both threshold and detection_filter rule
    keywords.

    Part of bug #425.

With rate_filter there is also a demand to override or combine the settings within the threshold.config and the used rules. This should match our documentation that when the ratelimit is reached the new_action should be applied and also needs to stay in that mode until timeout is reached. At the moment it's overriden by the threshold settings within the rule. (summary from discussion on the oisf-users ML with topic [Oisf-users] threshold.conf with rate_limit or drop rules in 9/2017)

Hi,
I came across this issue while reading the documentation. I am trying to apply threshold to limit the number of events generated by each rule/signatures. So, tried adding threshold.config as below but it is seems it's not supported yet.

/etc/suricata/threshold.config

threshold gen_id 0, sig_id 0, type limit, track by_rule, count 1, seconds 10

/var/log/suricata/suricata.log

28/4/2021 -- 09:04:47 - <Error> - [ERRCODE: SC_ERR_PCRE_MATCH(2)] - pcre_exec parse error, ret -1, string , type limit, track by_rule, count 1, seconds 10
28/4/2021 -- 09:04:47 - <Info> - Threshold config parsed: 1 rule(s) found

I wanted to have a global threshold so that, logs aren't filled up with similar events from same signature in a short span like 10 seconds.
Is there any other way to do this?
Thanks!