Rules management Tab

Suricata Rule Management Tab #

Welcome to the Suricata Rule Management Tab. This Tab provides comprehensive tools for managing and manipulating Suricata rules through a web interface. The system allows for viewing, editing, adding, and removing Suricata rules effectively and safely.

System Overview #

The Rule Management System utilizes a backend service to interact with Suricata rules stored in a specified rules file. The system features include rule validation, creation, modification, and deletion. Additionally, it supports querying rules by various parameters such as action, protocol, and status.

Key Features #

1. Viewing Rules:

   • Retrieve a paginated list of rules or specific rules by SID, action, status, or protocol.

   • Usage: Send a GET request to the appropriate endpoint (/rules, /rules/by_sid/{sid}, /rules/by_action/{action}, /rules/by_status/{status}, /rules/by_protocol/{proto}).

2. Adding Rules:

   • Add new rules to the system, with validation to ensure they are correct before inclusion.

   • Usage: Send a POST request to /rules/add with the rule content in JSON format.

3. Editing Rules:

   • Modify existing rules. The system validates the new rule to ensure it is correct and updates it in the rule file.

   • Usage: Send a PUT request to /rules/update with both the old and new rule content in JSON format.

4. Deleting Rules:

   • Remove rules from the system. This feature ensures that the rule is removed from the rule file safely.

   • Usage: Send a DELETE request to /rules/delete with the rule content to be removed in JSON format.

5. Rule Validation:

   • Validate rules using Suricata to ensure they are syntactically and semantically correct.

   • Usage: Send a POST request to /rules/validate with the rule content.

6. Reloading Rules:

   • Reload the Suricata rules without restarting the service, supporting both blocking and non-blocking operations.

   • Usage: Use /rules/reload for blocking reload and /rules/reload_nonblocking for non-blocking.

7. Rule Status Toggling:

   • Enable or disable rules directly by toggling the comment status of rule lines.

   • Usage: Send a POST request to /rules/toggle with the rule content.

CORS Support #

• All HTTP responses include CORS (Cross-Origin Resource Sharing) headers, allowing the system to be accessed from various clients across different domains.

Error Handling #

• The system provides detailed error messages in the HTTP response to assist in diagnosing issues during rule management operations.

Configuration and Setup #

• System configuration is managed through a configuration file (config++.conf), which includes settings for paths to the rule file and other operational parameters.

Integration Tips #

• Ensure that your client application handles JSON responses properly, as all communications with the backend are in JSON format.

• Regularly backup your rules file to prevent data loss during rule management operations.

This user guide aims to provide you with all the necessary information to use the Suricata Rule Management System effectively. Whether you are integrating it into an existing system or using it as a standalone service, the tools provided will help maintain and manage your Suricata rules efficiently.