webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-28 11:43:25 +02:00
Code Issues Packages Projects Releases Wiki Activity

ruleset-sources: Add additional providers.

Browse Source 
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
This commit is contained in:
Stefan Schantl
2021-04-05 07:12:00 +02:00
parent 4015d3f499
commit 6cbed0c213
1 changed files with 100 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

100
config/suricata/ruleset-sources
View File

@@ -66,4 +66,104 @@ our %Providers = (
dl_url => "https://rules.emergingthreatspro.com/<subscription_code>/suricata-5.0/etpro.rules.tar.gz",
dl_type => "archive",
},
# Abuse.ch SSLBL JA3 fingerprint rules.
sslbl_ja3 => {
summary => "Abuse.ch SSLBL JA3 Rules",
website => "https://sslbl.abuse.ch/",
tr_string => "sslbl ja3 fingerprint rules",
requires_subscription => "False",
dl_url => "https://sslbl.abuse.ch/blacklist/ja3_fingerprints.rules",
dl_type => "plain",
},
# Abuse.ch SSLBL Blacklist rules.
sslbl_blacklist => {
summary => "Abuse.ch SSLBL Blacklist Rules",
website => "https://sslbl.abuse.ch/",
tr_string => "sslbl blacklist rules",
requires_subscription => "False",
dl_url => "https://sslbl.abuse.ch/blacklist/sslblacklist.rules",
dl_type => "plain",
},
# Abuse.ch URLhaus Blacklist rules.
urlhaus => {
summary => "Abuse.ch URLhaus Blacklist Rules",
website => "https://urlhaus.abuse.ch/",
tr_string => "urlhaus blacklist rules",
requires_subscription => "False",
dl_url => "https://urlhaus.abuse.ch/downloads/urlhaus_suricata.tar.gz",
dl_type => "archive",
},
# Etnetera Aggressive Blacklist.
etnetera_aggresive => {
summary => "Etnetera Aggressive Blacklist Rules",
website => "https://security.etnetera.cz/",
tr_string => "etnetera aggressive blacklist rules",
requires_subscription => "False",
dl_url => "https://security.etnetera.cz/feeds/etn_aggressive.rules",
dl_type => "plain",
},
# OISF Traffic ID rules.
oisf_trafficid => {
summary => "OISF Traffic ID Rules",
website => "https://www.openinfosecfoundation.org/",
tr_string => "oisf traffic id rules",
requires_subscription => "False",
dl_url => "https://openinfosecfoundation.org/rules/trafficid/trafficid.rules",
dl_type => "plain",
},
# Positive Technologies Attack Detection Team rules.
attack_detection => {
summary => "PT Attack Detection Team Rules",
website => "https://github.com/ptresearch/AttackDetection",
tr_string => "attack detection team rules",
requires_subscription => "False",
dl_url => "https://raw.githubusercontent.com/ptresearch/AttackDetection/master/pt.rules.tar.gz",
dl_type => "archive",
},
# Secureworks Security rules.
secureworks_security => {
summary => "Secureworks Security Ruleset",
website => "https://www.secureworks.com",
tr_string => "secureworks security ruleset",
requires_subscription => "True",
dl_url => "https://ws.secureworks.com/ti/ruleset/<subscription_code>/Suricata_suricata-security_latest.tgz",
dl_type => "archive",
},
# Secureworks Malware rules.
secureworks_malware => {
summary => "Secureworks Malware Ruleset",
website => "https://www.secureworks.com",
tr_string => "secureworks malware ruleset",
requires_subscription => "True",
dl_url => "https://ws.secureworks.com/ti/ruleset/<subscription_code>/Suricata_suricata-malware_latest.tgz",
dl_type => "archive",
},
# Secureworks Enhanced rules.
secureworks_enhanced => {
summary => "Secureworks Enhanced Ruleset",
website => "https://www.secureworks.com",
tr_string => "secureworks enhanced ruleset",
requires_subscription => "True",
dl_url => "https://ws.secureworks.com/ti/ruleset/<subscription_code>/Suricata_suricata-enhanced_latest.tgz",
dl_type => "archive",
},
# Travis B. Green hunting rules.
tgreen => {
summary => "Travis Green - Hunting rules",
website => "https://github.com/travisbgreen/hunting-rules",
tr_string => "travis green hunting rules",
requires_subscription => "False",
dl_url => "https://raw.githubusercontent.com/travisbgreen/hunting-rules/master/hunting.rules",
dl_type => "plain",
},
);