Feature: Custom IDS/IPS Rules

[tpcr]

I would like to see the ability to use rules that I wrote for specific alerts

[AdSchellevis]

@tpcr you can just put your rule file in /usr/local/etc/suricata/rules/ and "download & update rules" should do the rest.
I tested it on my end by adding a rule in a newly created file "/usr/local/etc/suricata/rules/mytest.rules", works like a charm.

[tpcr]

I do not see a file manager in OPNsense and I do not know my way around Linux

[AdSchellevis]

For security reasons, there is no file manager in OPNsense. You have to use ssh or a physical console to manually edit files.

[fabianfrz]

Hi @tpcr, wou will see the rules in its tab after you do what @AdSchellevis described.

[tpcr]

I guess OPNsense is for Linux users only.

[fabianfrz]

@tpcr no, it is not. If you are using Windows, you can use WinSCP to copy the files, but you will have to enable SSH on your OPNsense machine.