Detection Tuning per sensor

[presianbg]

Version

2.4.140

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

42

RAM

128

Storage for /

300GB

Storage for /nsm

1TB

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hi,

One thing I've noticed is that there is no way to make Suricata rules tuning (exclusions) per sensor via the web interface.
Is this something which can be achieved via the cli, if so... what's the correct way to do it?

Cheers,
PY

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[TOoSmOotH]

This is currently not supported. Once we make some future changes to detections this might be possible. No ETA though.

[dougburks]

In the meantime, another way to think about this is to tune via the IP address range seen by the sensor in question. For example, instead of trying to disable a rule for a particular sensor, you could suppress the rule for the IP address range seen by that sensor.

https://docs.securityonion.net/en/2.4/nids.html#managing-existing-nids-rules

[presianbg]

Yes, this is what we are currently doing and its works just fine, until we have network overlap on different sites being monitored with different sensors.