poc2_worked

scripts/update-rules.sh

@@ -16,13 +16,15 @@ if ! command -v suricata-update >/dev/null 2>&1; then
 fi
 
 STATE_DIR="${SURICATA_STATE_DIR:-/data/suricata}"
-RULES="/var/lib/suricata/rules/suricata.rules"
+PERSIST_LIB_DIR="${SURICATA_PERSIST_LIB_DIR:-/data/lib/suricata}"
+RULES="${PERSIST_LIB_DIR}/rules/suricata.rules"
 SURICATA_CONFIG="${SURICATA_CONFIG:-/etc/suricata/suricata.yaml}"
+SURICATA_OUTPUT_CONFIG="${SURICATA_OUTPUT_CONFIG:-/opt/ids/suricata/ids-output.yaml}"
 SURICATA_HOME_NET="${SURICATA_HOME_NET:-[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]}"
 SURICATA_EXTRA_RULES_GLOB="${SURICATA_EXTRA_RULES_GLOB:-/data/suricata/*.rules}"
 SURICATA_THRESHOLD_CONFIG="${SURICATA_THRESHOLD_CONFIG:-/data/suricata/threshold.config}"
 
-mkdir -p "$STATE_DIR" /var/lib/suricata/rules
+mkdir -p "$STATE_DIR" "$PERSIST_LIB_DIR/rules"
 for name in disable.conf enable.conf modify.conf threshold.config; do
   [ -f "$STATE_DIR/$name" ] || : > "$STATE_DIR/$name"
 done
@@ -51,6 +53,7 @@ restore_previous_rules() {
 
 echo "[rules] downloading enabled feeds with suricata-update"
 if ! suricata-update \
+  -D "$PERSIST_LIB_DIR" \
   --disable-conf="$STATE_DIR/disable.conf" \
   --enable-conf="$STATE_DIR/enable.conf" \
   --modify-conf="$STATE_DIR/modify.conf"; then
@@ -64,10 +67,15 @@ fi
 echo "[rules] validating downloaded rules before activation"
 if ! suricata -T \
   -c "$SURICATA_CONFIG" \
+  --include "$SURICATA_OUTPUT_CONFIG" \
   -l "$VALIDATE_LOG" \
   -s "$SURICATA_EXTRA_RULES_GLOB" \
   --set "vars.address-groups.HOME_NET=$SURICATA_HOME_NET" \
-  --set "threshold-file=$SURICATA_THRESHOLD_CONFIG"; then
+  --set "threshold-file=$SURICATA_THRESHOLD_CONFIG" \
+  --set "default-rule-path=$PERSIST_LIB_DIR/rules" \
+  --set "app-layer.protocols.tls.ja3-fingerprints=yes" \
+  --set "app-layer.protocols.tls.ja4-fingerprints=yes" \
+  --set "app-layer.protocols.ssh.hassh=yes"; then
   echo "[rules] validation failed; restoring previous known-good rules" >&2
   restore_previous_rules
   exit 11