Suricata & Snort subscription rules



  • G'day all

    I have Suricata + the paid Snort rules when I login to the Snort page they have several versions of the Subscription rules

    snortrules-snapshot-2990.tar.gz
    snortrules-snapshot-29110.tar.gz
    snortrules-snapshot-2983.tar.gz

    do I need to consider anything when adding the filename into Suricata



  • @JasonAU:

    G'day all

    I have Suricata + the paid Snort rules when I login to the Snort page they have several versions of the Subscription rules

    snortrules-snapshot-2990.tar.gz
    snortrules-snapshot-29110.tar.gz
    snortrules-snapshot-2983.tar.gz

    do I need to consider anything when adding the filename into Suricata

    Suricata, unlike Snort, is not locked to a specific version of VRT rules like Snort is.  So you can use any of those packages, but I think most folks stay with whatever Snort binary version is current.  Last time I checked, that was 2.9.9.0; so the snortrules-snapshot-2990.tar.gz file would be the one to enter in the Suricata box.

    Bill



  • Thankyou ! :-)