first commit

scripts/update-rules.sh

@@ -0,0 +1,31 @@
+#!/bin/sh
+set -eu
+
+if ! command -v suricata-update >/dev/null 2>&1; then
+  cd "$(dirname "$0")/.."
+  if command -v docker >/dev/null 2>&1; then
+    exec docker compose exec -T ids /opt/ids/scripts/update-rules.sh
+  fi
+  echo "suricata-update is not installed; run this script inside the IDS container" >&2
+  exit 2
+fi
+
+suricata-update
+RULES=/var/lib/suricata/rules/suricata.rules
+LOCAL=/opt/ids/suricata/local.rules
+if ! grep -q 'sid:1000001;' "$RULES"; then
+  printf '\n# ---- local project rules ----\n' >> "$RULES"
+  cat "$LOCAL" >> "$RULES"
+fi
+chown suricata:suricata "$RULES"
+
+PID=""
+if [ -f /run/suricata.pid ]; then
+  PID="$(cat /run/suricata.pid)"
+fi
+if [ -n "$PID" ] && kill -0 "$PID" 2>/dev/null; then
+  kill -USR2 "$PID"
+  echo "Rules updated; live reload requested for Suricata PID $PID"
+else
+  echo "Rules updated; Suricata is not currently running"
+fi