doc: update rule section to current default

Update the rule section to better describe whats seen in a default
install of Suricata including a link to the rule management section.
pull/6809/head
Jason Ish 5 years ago committed by Victor Julien
parent 9d7a497cc1
commit 8071d8239e

@ -1806,37 +1806,40 @@ firewall at rule number 5500:
Rules Rules
----- -----
Rule-files Rule Files
~~~~~~~~~~ ~~~~~~~~~~
For different categories of risk there are different rule-files Suricata by default is setup for rules to be managed by Suricata-Update with
available containing one or more rules. There is a possibility to the following rule file configuration:
instruct Suricata where to find these rules and which rules you want
to be load for use. You can set the directory where the files can be
found.
:: .. code-block:: yaml
default-rule-path: /var/lib/suricata/rules
rule-files:
- suricata.rules
A default installation of Suricata-Update will write out the rules to
/var/lib/suricata/rules/suricata.rules.
You may want to edit this section if you are not using Suricata-Update or want
to add rule files that are not managed by Suricata-Update, for example:
.. code-block:: yaml
default-rule-path: /etc/suricata/rules/ default-rule-path: /var/lib/suricata/rules
rule-files: rule-files:
- backdoor.rules - suricata.rules
- bad-traffic.rules - /etc/suricata/rules/custom.rules
- chat.rules
- ddos.rules
- ....
The above mentioned is an example of rule-files of which can be chosen File names can be specific with an absolute path, or just the base name. If
from. There are much more rule-files available. just the base name is provided it will be looked for in the
``default-rule-path``.
If wanted, you can set a full path for a specific rule or If a rule file cannot be found, Suricata will log a warning message and
rule-file. In that case, the above directory (/etc/suricata/rules/) continue to load, unless ``--init-errors-fatal`` has been specified on the
will be ignored for that specific file. This is convenient in case you command line, in which case Suricata will exit with an error code.
write your own rules and want to store them separate from other rules
like that of VRT, ET or ET pro.
If you set a file-name that appears to be not existing, Suricata will For more information on rule management see :doc:`../rule-management/index`.
ignore that entry and display a error-message during the engine
startup. It will continue with the startup as usual.
Threshold-file Threshold-file
~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~

Loading…
Cancel
Save