Project

General

Profile

Actions

Feature #3203

closed

manage classification.config

Added by Victor Julien about 5 years ago. Updated about 4 years ago.

Status:
Closed
Priority:
High
Target version:
Effort:
Difficulty:
Label:

Description

To enable rulesets to introduce new classtypes, and to allow multiple rulesets to co-exist, Suricata-Update should manage classification.config.

It should take the local one (/etc/suricata/classification.config) plus any that is part of the rulesets and merge them.
Since Suricata ships some rules, it should also include one we ship, so /usr/share/suricata/...

The resulting file should go somewhere in /var/lib/suricata/

(side note: we should probably do the same for reference.config)

In case of conflicting definitions, it should probably take the highest priority/severity.


Related issues 1 (0 open1 closed)

Blocks Suricata-Update - Feature #3202: classtypes: validate classtypes in useRejectedShivani BhardwajActions
Actions

Also available in: Atom PDF