doc: update rule section to current default

Update the rule section to better describe whats seen in a default
install of Suricata including a link to the rule management section.
pull/6809/head
Jason Ish 5 years ago committed by Victor Julien
parent 9d7a497cc1
commit 8071d8239e

@ -1806,37 +1806,40 @@ firewall at rule number 5500:
Rules Rules
----- -----
Rule-files Rule Files
~~~~~~~~~~ ~~~~~~~~~~
For different categories of risk there are different rule-files Suricata by default is setup for rules to be managed by Suricata-Update with
available containing one or more rules. There is a possibility to the following rule file configuration:
instruct Suricata where to find these rules and which rules you want
to be load for use. You can set the directory where the files can be
found.
:: .. code-block:: yaml
default-rule-path: /etc/suricata/rules/ default-rule-path: /var/lib/suricata/rules
rule-files: rule-files:
- backdoor.rules - suricata.rules
- bad-traffic.rules
- chat.rules A default installation of Suricata-Update will write out the rules to
- ddos.rules /var/lib/suricata/rules/suricata.rules.
- ....
You may want to edit this section if you are not using Suricata-Update or want
The above mentioned is an example of rule-files of which can be chosen to add rule files that are not managed by Suricata-Update, for example:
from. There are much more rule-files available.
.. code-block:: yaml
If wanted, you can set a full path for a specific rule or
rule-file. In that case, the above directory (/etc/suricata/rules/) default-rule-path: /var/lib/suricata/rules
will be ignored for that specific file. This is convenient in case you rule-files:
write your own rules and want to store them separate from other rules - suricata.rules
like that of VRT, ET or ET pro. - /etc/suricata/rules/custom.rules
If you set a file-name that appears to be not existing, Suricata will File names can be specific with an absolute path, or just the base name. If
ignore that entry and display a error-message during the engine just the base name is provided it will be looked for in the
startup. It will continue with the startup as usual. ``default-rule-path``.
If a rule file cannot be found, Suricata will log a warning message and
continue to load, unless ``--init-errors-fatal`` has been specified on the
command line, in which case Suricata will exit with an error code.
For more information on rule management see :doc:`../rule-management/index`.
Threshold-file Threshold-file
~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~

Loading…
Cancel
Save