Tuning Suricata signatures

[netsecninja]

Details: 2.3.2 ISO, Standalone install

I was attempting to follow the documentation here to tune out some FPs. However, when I run the salt securityonion_standalone state.highstate command as documented, it removes my tuned rules in /opt/so/rules/nids/local.rules.

I tried running salt securityonion_standalone state.apply idstools instead after modifying the STS and writing the new rules in /opt/so/rules/nids/local.rules, however even running that deletes the contents in local.rules. So I don't know if the documentation is incorrect or I'm just not understanding salt well enough.

Reading more here, the hint was given to modify the /opt/so/saltstack/local/salt/idstools/localrules/local.rules file. That file did not exist, however /opt/so/saltstack/local/salt/idstools/local.rules did. So I added my new rule to that file, and had to run salt securityonion_standalone state.apply idstools. Then I ran so-rule-update. Now in /opt/so/rules/nids/all.rules the old rule is disabled, and the new rule is listed.

Is this how are we supposed to tune rules? If so, would you please update the documentation to reflect the proper steps?

1. Identify the rule SID you want to tune
2. Run grep <SID> /opt/so/rules/nids/all.rules, copy the rule syntax
3. Edit /opt/so/saltstack/local/salt/idstools/local.rules
4. Paste the rule, make appropriate modifications
5. Replace the SID with one above 90000000, and a revision of 1, then save
6. Disabled old rule SID in /opt/so/saltstack/local/pillar/minions/<minionid>.sls, under idstools > sids > disabled
7. Run sudo salt securityonion_standalone state.apply idstools
8. Run sudo so-rule-update