Differences

This shows you the differences between two versions of the page.

--- tips:suricata-eve-unixsocket [2020/08/27 19:10] – [7. Viewing Alerts] navaneeth
+++ tips:suricata-eve-unixsocket [2020/09/10 17:45] – [3. Installing Emerging Threat Rules 5.0] navaneeth
@@ Line 21: / Line 21: @@
 </code>
-==== 3. Installing Emerging Threat Rules 5.0 ====
+===== Updating with latest ruleset =====
+Use the following command to update the latest emerging-threats ruleset
+<code>sudo suricata-update</code>
+suricata-update puts the combined rules in ''/var/lib/suricata/rules'' which is owned by root. Make sure the trisul user can read this directory.
+<code>sudo chown trisul.trisul /var/lib/suricata -R </code>
-  * You have to install the Emerging Threats Community which are a set of rules that trisul will listen to.
-  * Download and install Emerging Threats Open rules into ///etc/suricata//
-<code>#cd /etc/suricata
-#wget https://rules.emergingthreats.net/open/suricata-5.0.0/emerging.rules.tar.gz
-#tar xf emerging.rules.tar.gz
-</code>
-<note important>Please ensure that you run these commands as root</note>
 ==== 4. Enabling EVE_unix Socket ====
@@ Line 64: / Line 70: @@
 {{:tips:suricata-alert.png?600|}}
-==== 7. Updating with latest ruleset ====
-If you have already installed suricata and you want to update with the latest rules. Use the following command.
-<code>sudo suricata-update</code>