Suricata rules restored to default state

[AlexRtveliashvili]

Version

2.4.110

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

8

RAM

32

Storage for /

500

Storage for /nsm

300

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hello SO team,

After a full update of Suricata rules all the modifications that we had made to the Suricata ruleset (Modifications in detection source, Tuning, Enabled and Disabled rules) were reverted back to default state. Created Suricata rules by the engineers however were unaffected.

Tuning of existing Suricata rules were removed.

Thanks for any feedback in advance, reply in thread if you need any more details.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[InfosecGoon]

The rule tuning that was removed was done through the Detections interface, correct? Did you change anything Suricata-related in the Configuration interface for SOC?

[AlexRtveliashvili]

Yes, the rule tuning was done through the detections interface and I didn't change anything suricata-related in the configuration interface for SOC.