Rulesets¶

The Rulesets tab manages rulesets for Snort from a variety of sources. There is some overlap with the Rules Download Service which automatically populates its remote ruleset entries into this list.

Ruleset List¶

A list of all configured rulesets, including rulesets defined in the Rules Download Service.

Note

Rulesets do not always populate every column. Only certain special ruleset archive formats contain type and policy information, for example.

Name: The name of the ruleset.
Type: The type of ruleset, if known. For example, rules for a collection of rules, snapshot for a Snort rules snapshot, lightspd for a Talos LightSPD ruleset.
Policies: List of base layer policies supported by the ruleset, if any. Each policy enables different sets of rules to easily enact specific levels of detection.
Version: The version number of the ruleset, if known.
Downloaded: For remote rulesets, this is a timestamp indicating the last time Netgate Nexus downloaded the ruleset.
Source: The source of the rules, such as a URL or file path.
Status: Current status of the ruleset, if known.

Action Icons

Show Rules
Opens the Show Rules view to display the contents of a ruleset.

Delete
Removes the ruleset and its contents.

Note

For entries configured in the Rules Download Service, this does not remove entries from that system. Downloading and updating the rules again from there will add them back to this tab.

Show Rules¶

The Show Rules interface browses the metadata and contents of a ruleset and its files.

Archive Info

The Archive Info tab displays metadata about the rules archive and some of its contents.

Version

The version number of the rules archive, if present.

Download Time

The last time Netgate Nexus downloaded the ruleset.

State

The current status of the ruleset, if known. For example, most of the time it will say Idle or OK, but it will also indicate here if Netgate Nexus is updating the ruleset.

Source Location

The source URL or path for the ruleset.

Files

This section contains a list of the files in the archive.

Clicking a filename displays the raw, unparsed content of that rules file.

Rules

The Rules tab displays parsed content from rulesets.

Rule Categories

This section lists the rules files in the archive followed by the number of rules contained within each file.

Clicking an item in the list opens a table with parsed rule content.

IPS State

The IPS State tab displays a parsed table of policy file content if the ruleset supports policies.

IPS State Categories

This section lists the category files in the archive followed by the number of rule IDs defined in the policy.

Clicking a category in the list opens a table containing a list of rule IDs, actions, and whether the policy entry is enabled.

Add Ruleset¶

Clicking in the toolbox opens a dialog to add a new ruleset. The available options vary depending on the source of the rules.

Name

A name for this ruleset.

Rules Source

Selects the type of source for rule data. The other options change depending on the value of this setting.

URL

Fetches ruleset contents from a remote URL.

Consider adding these under Rules Download Service instead.

Download URL: The full URL to the ruleset archive.

Text

Enter rules in plain text.

Rules: The content of the custom ruleset, one rule per line.

File

Upload a ruleset file from the client device.

Rules File: Click this field to select a file to upload from the client device.