worked poc

2026-08-14 11:33:01 +02:00
parent adfdb0b86c
commit fc3a2944b2
94 changed files with 2931 additions and 3412 deletions
@@ -0,0 +1,9 @@
+# Environment-specific local signatures live here after first startup.
+# This file is copied to /data/suricata/custom.rules and is not overwritten.
+#
+# Built-in production rules use SIDs 1000101-1000108. Reserve 1000001 for the
+# pipeline self-test. Use 1001000+ for your own site-specific signatures to
+# avoid accidental collisions with the image baseline.
+#
+# Example (disabled/commented):
+# alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"LOCAL SITE suspicious URI marker"; flow:established,to_server; http.uri; content:"/admin/export"; nocase; classtype:web-application-activity; priority:2; sid:1001000; rev:1;)