Hi there,
How can I list the total number of active drop and alert rules?
Is it possible in the gui or are there any commands for the shell.
Thx.
Count all enabled rules:
# sqlite3 -readonly /usr/local/etc/suricata/rules/rules.sqlite "SELECT COUNT(*) FROM rules WHERE enabled = True;"
Count only enabled 'drop' rules:
# sqlite3 -readonly /usr/local/etc/suricata/rules/rules.sqlite "SELECT COUNT(*) FROM rules WHERE enabled = True AND action LIKE 'drop';"
Count only enabled 'alert' rules:
# sqlite3 -readonly /usr/local/etc/suricata/rules/rules.sqlite "SELECT COUNT(*) FROM rules WHERE enabled = True AND action LIKE 'alert';"
Perfect!
Thank you very much!
You're welcome. :)