# Environment-specific local signatures live here after first startup.
# This file is copied to /data/suricata/custom.rules and is not overwritten.
#
# Built-in production rules use SIDs 1000101-1000108. Reserve 1000001 for the
# pipeline self-test. Use 1001000+ for your own site-specific signatures to
# avoid accidental collisions with the image baseline.
#
# Example (disabled/commented):
# alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"LOCAL SITE suspicious URI marker"; flow:established,to_server; http.uri; content:"/admin/export"; nocase; classtype:web-application-activity; priority:2; sid:1001000; rev:1;)