Reference

suricata-update(1)

tool to update Suricata sources

NAME

suricata-update - tool to update Suricata sources

DESCRIPTION

usage: suricata-update update [-h] [-v] [-q] [-D <directory>] [-c <filename>]

[--suricata-conf <filename>] [--suricata <path>]

[--suricata-version <version>] [-V] [-s] [-o <directory>] [-f] [--disable-conf <filename>] [--enable-conf <filename>] [--modify-conf <filename>] [--drop-conf <filename>] [--no-reload] [--no-test] [--offline] [--fail]

options:

-h, --help

show this help message and exit

-v, --verbose

Be more verbose

-q, --quiet

Be quiet, warning and error messages only

-D, --data-dir <directory>

Data directory (default: /var/lib/suricata)

-c, --config <filename>

configuration file (default: /etc/suricata/update.yaml)

--suricata-conf <filename>

configuration file (default: /etc/suricata/suricata.yaml)

--suricata <path>

Path to Suricata program

--suricata-version <version>

Override Suricata version

-V, --version

Display version

-s, --show-advanced

Show advanced options

-o, --output <directory>

Directory to write rules to

-f, --force

Force operations that might otherwise be skipped

--disable-conf <filename>

Filename of rule disable filters

--enable-conf <filename>

Filename of rule enable filters

--modify-conf <filename>

Filename of rule modification filters

--drop-conf <filename>

Filename of drop rule filters

--no-reload

Disable reload

--no-test

Disable testing rules with Suricata

--offline

Run offline using most recent cached rules

--fail

Strictly fail and exit in case of an error

other commands:

update-sources

Update the source index

list-sources

List available sources

enable-source

Enable a source from the index

disable-source

Disable an enabled source

remove-source

Remove an enabled or disabled source

add-source

Add a new source by URL

check-versions

Check version of suricata-update

SEE ALSO

More information on suricata-update can be found in the online documentation ⟨https://suricata-update.readthedocs.io⟩.

History

--fail since Debian 12 (Bookworm); --offline since Debian 11 (Bullseye); --show-advanced since Debian 13 (Trixie); -s since Debian 13 (Trixie).

--dump-sample-configs until Debian 12 (Bookworm); --etopen until Debian 12 (Bookworm); --ignore until Debian 12 (Bookworm); --local until Debian 12 (Bookworm); --no-check-certificate until Debian 12 (Bookworm); --no-ignore until Debian 12 (Bookworm); --no-merge until Debian 12 (Bookworm); --reload-command until Debian 12 (Bookworm); --sid-msg-map until Debian 12 (Bookworm); --sid-msg-map-2 until Debian 12 (Bookworm); --test-command until Debian 12 (Bookworm); --threshold-in until Debian 12 (Bookworm); --threshold-out until Debian 12 (Bookworm); --url until Debian 12 (Bookworm); --user-agent until Debian 12 (Bookworm); --yaml-fragment until Debian 12 (Bookworm); -T until Debian 12 (Bookworm).