10 lines
622 B
Plaintext
10 lines
622 B
Plaintext
# Environment-specific local signatures live here after first startup.
|
|
# This file is copied to /data/suricata/custom.rules and is not overwritten.
|
|
#
|
|
# Built-in production rules use SIDs 1000101-1000108. Reserve 1000001 for the
|
|
# pipeline self-test. Use 1001000+ for your own site-specific signatures to
|
|
# avoid accidental collisions with the image baseline.
|
|
#
|
|
# Example (disabled/commented):
|
|
# alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"LOCAL SITE suspicious URI marker"; flow:established,to_server; http.uri; content:"/admin/export"; nocase; classtype:web-application-activity; priority:2; sid:1001000; rev:1;)
|