Exclude domain from Suricata
-
Hello,
I am trying to understand if Suricata allows to exclude a particular domain from being blocked.
I have SID 2027758 (emerging-dns.rules) enabled which blocks DNS query for .cc TLD. Now I want to exclude a domain from from this rule let's say "xyz.cc". Is it possible?Thanks.
-
@milindhvijay said in Exclude domain from Suricata:
Hello,
I am trying to understand if Suricata allows to exclude a particular domain from being blocked.
I have SID 2027758 (emerging-dns.rules) enabled which blocks DNS query for .cc TLD. Now I want to exclude a domain from from this rule let's say "xyz.cc". Is it possible?Thanks.
You can copy that rule over into a custom rule and then edit the action to be PASS instead of ALERT. You will need to give your custom rule a different SID that is unique from all the other SIDs in use. But be aware that PASS rules supersede all other rules, and once a PASS rule matches, that traffic flow bypasses all other rules. But you can do what you ask using a custom rule.
-
@bmeeks I have no idea what you mean by any of this.
-
@milindhvijay said in Exclude domain from Suricata:
@bmeeks I have no idea what you mean by any of this.
I don't know what your experience level is with managing an IPS. If you want to read the documentation on creating Suricata rules, here is a link to the official docs: https://docs.suricata.io/en/suricata-7.0.4/rules/index.html.
If you don't know how to write rules, and don't want to learn, then you won't be able to accomplish what you desire because doing so requires a custom rule.
-
@bmeeks You are right. I have "zero" experience with managing an IPS. I really didn't understand what you meant before till I read your post about passlists.
I was able to create a custom rule that pass DNS query to my specific domain. Thanks.
