Suricata rules with "flowbits:noalert" are blocked (false positive)

[xiic]

I've enabled the Suricata rule "emerging-trojan" and enabled "Change all alerts to drop actions".

This triggers a lot of false positives. It looks like I'm not the only one with this problem (https://forum.opnsense.org/index.php?topic=10198).
The offending rule is for example ID 2022317:
https://doc.emergingthreats.net/bin/view/Main/2022317

The rule specifies "flowbits:noalert". If I understand the folks at PT Research/EmergingThreats correctly, a rule with flowbits:nolert should not trigger an alert and should not be blocked (ptresearch/AttackDetection#7).

The Suricata docs suggest the same:
https://suricata.readthedocs.io/en/suricata-4.1.2/rules/flow-keywords.html

flowbits: noalert
No alert will be generated by this rule.

Expected behavior
No alert or block should be triggered if flowbits:noalert is set.

Environment
OPNsense 19.1.4-amd64
FreeBSD 11.2-RELEASE-p9-HBSD
Suricata version 4.1.3 RELEASE

[AdSchellevis]

Just to be very sure, when changing this rule to alert you're not receiving events?
The rule in question is:

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Zbot download config - SET"; flow:established,to_server; content:"GET"; http_method; content:".dat"; http_uri; content:!"Content-Type|3a|"; http_header; content:!"Referer"; http_header; pcre:"/\.dat$/U"; flowbits:set,ET.zbot.dat; flowbits:noalert; classtype:trojan-activity; sid:2022317; rev:2; metadata:created_at 2015_12_30, updated_at 2015_12_30;)

If it only happens on drops, we could probably just filter those out and leave them default.

[AdSchellevis]

6de0048 should leave the noalert flowbits as is, to test:

opnsense-patch 6de0048
rm /usr/local/etc/suricata/rules/emerging-trojan.rules

And download again.

[xiic]

Looks good, with the patch everything works as expected. Thank you for the fast fix and the great support!

[AdSchellevis]

@xiic thanks for confirming

[Julien-nl]

When we chose change action from alert to drop, would i see the alert on the Alert page ?
after the update i am not seeing the Alerts at all.

[xiic]

This patch only applies to rules containing flowbits:noalert; - those rules should neither be blocked nor trigger an alert. Before this patch there were a lot of false positive alerts.

Real dropped actions still trigger an alert on my system.