Configuration: Antiphishing Ruleset on IDSTower

This guide provides step-by-step instructions on how to integrate and automate the julioliraup/Antiphishing ruleset into your IDSTower environment.

By following this manual, your Suricata clusters will automatically fetch high-frequency, dynamic phishing definitions (SIDs 6000000 to 6100000) packaged directly from the repository.

---

Technical Details

• Feed URL: https://github.com/julioliraup/Antiphishing/raw/refs/heads/main/antiphishing.tar.gz
• Format: Compressed Tarball (.tar.gz) containing Suricata-compatible .rules and md5 files.
• Target SID Range: 6000000 - 6100000

---

Step 1: Add the Antiphishing Feed Source

IDSTower manages external threat intelligence and rule sets via its central Feeds interface.

1. Log in to your IDSTower Web Interface.
2. Navigate to the left sidebar menu and click on Settings, then select the Feeds tab.
3. Click the Add New Feed button at the top right of the screen.
4. Configure the feed details as follows:
   • Feed Name: Julioliraup/Antiphishing Ruleset
   • Feed Type: Suricata Rules (Tarball)
   • Feed URL: https://github.com/julioliraup/Antiphishing/raw/refs/heads/main/antiphishing.tar.gz
   • Update Interval: Select your preferred synchronization frequency (Daily or Hourly is recommended due to the fast-evolving nature of phishing URLs).
5. Click Verify Connection to ensure IDSTower can successfully reach and read the GitHub link.
6. Click Save / Update Feed.

---

Step 2: Review and Enable the Imported Rules

Once IDSTower successfully processes the compressed tarball, the rules will populate your central database. You need to activate them.

1. Go to the Rules Management or IDS Rules menu on your sidebar.
2. Use the search/filter bar to isolate the julioliraup/Antiphishing signatures:
   • You can filter by SID Range: 6000000-6100000
   • Alternatively, search for the author signature or rule category keywords like phishing.
3. Select all the imported rules using the master checkbox.
4. Click on the Actions dropdown menu and select Enable.

---

Step 3: Deploy Rules to Your Suricata Clusters

Enabling the rules in the database does not automatically push them to your sensors. You must apply them to your cluster profiles.

1. In the Rules Management area, ensure your enabled antiphishing rules are assigned to your active Rule Template or directly mapped to your target Clusters.
2. Verify that your Suricata hosts are listed under the active deployment profile.
3. Click the Deploy Changes button (or Push Updates) located at the top notification banner or within your Cluster dashboard.
4. Wait for the deployment job to finish. IDSTower will build the new ruleset package and securely push it to all managed Suricata nodes.

---

Step 4: Verification

To make sure your nodes are successfully running the new antiphishing signatures:

1. Check the Cluster Status tab in IDSTower to ensure the last deployment job completed without syntax errors.
2. (Optional) Run a quick test flag or look into your Suricata alert logs (eve.json) on a managed node to verify that signatures within the 6000000 range are active.