Signed-off-by: Stefan Schantl <[email protected]>
---
config/suricata/ruleset-sources | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
diff --git a/config/suricata/ruleset-sources b/config/suricata/ruleset-sources
index af65648af..5b9073d85 100644
--- a/config/suricata/ruleset-sources
+++ b/config/suricata/ruleset-sources
@@ -13,6 +13,8 @@ package IDS::Ruleset;
# requires_subscription => "True/False" - If some kind of registration
code is required in order to download the ruleset.
# dl_url => The download URL to grab the ruleset.
# dl_type => "archive/plain" - To specify, if the downloaded file is a
packed archive or a plain text file.
+# sid_range => The sid range which the provider uses for it's rules,
specified as an array. "[start sid, stop sid]"
+# sid_info_url => An URL which provides additional information about a
rule based on it's sid.
# },
# Hash which contains the supported ruleset providers.
@@ -25,6 +27,8 @@ our %Providers = (
requires_subscription => "True",
dl_url =>
"https://www.snort.org/rules/snortrules-snapshot-29200.tar.gz?oinkcode=<subscription_code>",
dl_type => "archive",
+ sid_range => ["1", "1000000"],
+ sid_info_url => "https://www.snort.org/rule_docs/1-<sid>",
},
# Ruleset for registered sourcefire users with a valid subscription.
@@ -35,6 +39,8 @@ our %Providers = (
requires_subscription => "True",
dl_url =>
"https://www.snort.org/rules/snortrules-snapshot-29200.tar.gz?oinkcode=<subscription_code>",
dl_type => "archive",
+ sid_range => ["1", "1000000"],
+ sid_info_url => "https://www.snort.org/rule_docs/1-<sid>",
},
# Community rules from sourcefire.
@@ -45,6 +51,8 @@ our %Providers = (
requires_subscription => "False",
dl_url =>
"https://www.snort.org/downloads/community/community-rules.tar.gz";,
dl_type => "archive",
+ sid_range => ["1", "1000000"],
+ sid_info_url => "https://www.snort.org/rule_docs/1-<sid>",
},
# Emerging threats community rules.
@@ -55,6 +63,8 @@ our %Providers = (
requires_subscription => "False",
dl_url =>
"https://rules.emergingthreats.net/open/suricata-5.0/emerging.rules.tar.gz";,
dl_type => "archive",
+ sid_range => ["2000000", "2999999"],
+ sid_info_url => "https://threatintel.proofpoint.com/sid/<sid>",
},
# Emerging threats Pro rules.
@@ -65,6 +75,8 @@ our %Providers = (
requires_subscription => "True",
dl_url =>
"https://rules.emergingthreatspro.com/<subscription_code>/suricata-5.0/etpro.rules.tar.gz",
dl_type => "archive",
+ sid_range => ["2000000", "2999999"],
+ sid_info_url => "https://threatintel.proofpoint.com/sid/<sid>",
},
# Abuse.ch SSLBL Blacklist rules.
@@ -72,6 +84,7 @@ our %Providers = (
summary => "Abuse.ch SSLBL Blacklist Rules",
website => "https://sslbl.abuse.ch/";,
tr_string => "sslbl blacklist rules",
+ sid_range => ["902200000", "902299999"],
},
# Etnetera Aggressive Blacklist.
@@ -82,6 +95,7 @@ our %Providers = (
requires_subscription => "False",
dl_url =>
"https://security.etnetera.cz/feeds/etn_aggressive.rules";,
dl_type => "plain",
+ sid_range => ["500000", "599999"],
},
# OISF Traffic ID rules.
@@ -92,6 +106,7 @@ our %Providers = (
requires_subscription => "False",
dl_url =>
"https://openinfosecfoundation.org/rules/trafficid/trafficid.rules";,
dl_type => "plain",
+ sid_range => ["300000000", "301000000"],
},
# Positive Technologies Attack Detection Team rules.
@@ -99,6 +114,7 @@ our %Providers = (
summary => "PT Attack Detection Team Rules",
website => "https://github.com/ptresearch/AttackDetection";,
tr_string => "attack detection team rules",
+ sid_range => ["10000000", "11999999"],
},
# Secureworks Security rules.
@@ -130,6 +146,7 @@ our %Providers = (
requires_subscription => "False",
dl_url =>
"https://threatfox.abuse.ch/downloads/threatfox_suricata.rules";,
dl_type => "plain",
+ sid_range => ["91000000", "91999999"],
},
# Travis B. Green hunting rules.
@@ -140,6 +157,7 @@ our %Providers = (
requires_subscription => "False",
dl_url =>
"https://raw.githubusercontent.com/travisbgreen/hunting-rules/master/hunting.rules";,
dl_type => "plain",
+ sid_range => ["2610000", "2619999"],
},
ipfire_dbl => {
@@ -149,5 +167,6 @@ our %Providers = (
requires_subscription => "False",
dl_url => "https://dbl.ipfire.org/lists/suricata.tar.gz";,
dl_type => "archive",
+ sid_range => ["406000000", "406999999"],
},
);
--
2.47.3
