rockfish rule

Manage Suricata detection rules and rule sources. rule update downloads and installs rules (like suricata-update); the other subcommands manage rule sources.

Overview

The rule update command manages Suricata rule sources — downloading rule archives (ET Open by default), applying local filter files (enable, disable, drop, modify), and writing a merged suricata.rules file. Optionally reloads Suricata after a successful update.

Usage

# Download rules, apply filters, write suricata.rules
rockfish rule update

# Force re-download and reload Suricata
rockfish rule update --force --reload

# Use ET Pro rules (requires oinkcode)
rockfish rule update --etpro YOUR_OINKCODE

# Include additional local rules
rockfish rule update --local /etc/suricata/rules/local.rules,/etc/suricata/rules/custom/

Options

Source Management

List available sources

rockfish rule list

Fetches the OISF source index and displays all available rule sources with their enabled/disabled status.

Enable a source

rockfish rule enable et/pro
rockfish rule enable oisf/trafficid

Disable a source

rockfish rule disable et/pro

Remove a source

Disables the source and deletes its cached archive:

rockfish rule remove et/pro

Refresh the source index

rockfish rule sync

Filter Files

Filter files control which rules are enabled, disabled, converted to drop, or modified. Place them in the config directory (/etc/suricata/ by default).

enable.conf

Force-enable rules matching the specified patterns:

# By SID
2100001

# By SID range
2100001-2100010

# By regex on rule text
re:ET SCAN

# By group (source filename)
group:emerging-scan.rules

disable.conf

Disable rules matching the specified patterns (same format as enable.conf):

# Disable noisy rules
re:ET INFO
2100498
group:emerging-deleted.rules

drop.conf

Change the action to drop for matching rules (same format):

# Drop all exploit rules
re:ET EXPLOIT

modify.conf

Regex find-and-replace on matching rules:

# Change action from alert to drop for specific SID
2100001 "alert" "drop"

# Change action for all SCAN rules
re:ET SCAN "alert" "drop"

YAML Configuration

Settings can also be specified in rockfish.yaml:

update:
  suricata_version: "7.0"
  data_dir: /var/lib/suricata
  config_dir: /etc/suricata
  output: /var/lib/suricata/rules/suricata.rules
  reload: true
  etpro_code: "YOUR_OINKCODE"

CLI arguments override YAML settings.

Pipeline

The update command follows this pipeline:

1. Resolve Suricata version (auto-detect via suricata -V or --suricata-version)
2. Download rule archives for each enabled source (ET Open by default)
3. Extract .rules files from tar.gz archives
4. Load additional local rule files (if --local is specified)
5. Parse all rules, extracting SIDs and group metadata
6. Apply filters in order: enable.conf → disable.conf → drop.conf → modify.conf
7. Write merged, deduplicated suricata.rules sorted by SID
8. Reload Suricata (if --reload is set) via suricatasc -c reload-rules

Reload Behavior

When --reload is specified, Rockfish attempts to reload Suricata rules:

1. First tries suricatasc -c reload-rules
2. Falls back to sending SIGUSR2 to the Suricata process (found via pidfile or pidof)

Default Rule Source

Without any additional sources enabled, Rockfish downloads the Emerging Threats Open ruleset:

https://rules.emergingthreats.net/open/suricata-{version}/emerging.rules.tar.gz

When an ET Pro oinkcode is provided (--etpro), ET Pro replaces ET Open:

https://rules.emergingthreatspro.com/{code}/suricata-{version}/etpro.rules.tar.gz

Examples

# Basic update with ET Open rules
rockfish rule update

# ET Pro with reload
rockfish rule update --etpro abc123 --reload

# Custom paths
rockfish rule update \
  --data-dir /opt/suricata/data \
  --config-dir /opt/suricata/etc \
  --output /opt/suricata/rules/suricata.rules

# Include local rules alongside downloaded rules
rockfish rule update --local /etc/suricata/rules/local.rules

# Force fresh download
rockfish rule update --force

# Automated cron job
rockfish rule update --reload --quiet

Cron Example

Run rule updates every 6 hours and reload Suricata:

0 */6 * * * /opt/rockfish/bin/rockfish rule update --reload --quiet 2>&1 | logger -t rockfish-update