diff --git a/docker/suricata/dist/update.sh b/docker/suricata/dist/update.sh index c9ca30ad..76c5de55 100755 --- a/docker/suricata/dist/update.sh +++ b/docker/suricata/dist/update.sh @@ -40,3 +40,20 @@ if [ "$myCHECK" == "0" ]; else echo "/etc/suricata/null.bpf" fi + +# Download rules via URL +if [ "$FROMURL" != "" ] ; then + SAVEIFS=$IFS ; IFS='|' + for URL in $FROMURL; do + if [ $(curl -I --silent --output /dev/null --write-out "%{http_code}" "$URL") -eq 200 ] ; then + rm -rf /tmp/* + curl "$URL" -o /tmp/rules.tar.gz + tar -xvf /tmp/rules.tar.gz -C /tmp + suricata-update --local /tmp/rules --no-test + rm -rf /tmp/* + else + continue + fi + done + IFS=$SAVEIFS +fi diff --git a/etc/compose/sensor.yml b/etc/compose/sensor.yml index c7317a72..14d7f70a 100644 --- a/etc/compose/sensor.yml +++ b/etc/compose/sensor.yml @@ -498,6 +498,8 @@ services: environment: # For ET Pro ruleset replace "OPEN" with your OINKCODE - OINKCODE=OPEN + # Loading externel Rules from URL + # - FROMURL="https://username:password@yoururl.com|https://username:password@otherurl.com" network_mode: "host" cap_add: - NET_ADMIN