Update, and I think I answered one of my own questions; I’ll post this update just in case anybody else is going through this. ![]()
I built a new VM with the latest ISO, and used the approach to installing suricata with a container as talked about out in this post: Vyos firewall artificial intelligence support.
The only change I did was used this command to bring down the “latest” suricata 7.0.8 container: ‘add container image jasonish/suricata:latest’. This is something I actually wanted an answer on as well, and confirmed what is running in the latest VyOS rolling ISO is suricata 6.0.10 vs. 7.0.8 in the “latest” container as seen in these commands:
vyos@vyos:~$ suricata -V
This is Suricata version 6.0.10 RELEASE
vyos@vyos:~$ sudo podman exec -it suricata /bin/bash
[root@vyos /]# suricata -V
This is Suricata version 7.0.8 RELEASE
After going through a more “straight-forward” suricata configuration in the container, I was able to replicate the functionality of adding additional rules using ‘suricata-update’ in the container, as well as the 6.0.10 version that is installed in the ISO file. Basically these commands work exactly the same:
‘suricata-update list-sources’
‘suricata-update update-sources’
‘suricata-update enable-source et/open’ (adding the ET Open rules)
‘suricata-update -v’ (verbose is key)
The only difference between what is in the ISO and the container is of course is the container has the latest 7.0.8 suricata. This answers my first question about adding rules the “proper way” to suricata, but then the question that is raised is will suricata in the ISO ever be updated to the latest? Or is the container the better/long-term approach to using suricata with VyOS?
As for the second question, I’d still like to hear feedback on what folks have done with actions to the alerts, especially if something is available outside of brute force modifying the rules to add “drop” to whatever rules necessary. While that can be done via scripting, I’d really rather NOT modify the rule files themselves if possible. Thanks again!