OPNsense Forum

English Forums => Intrusion Detection and Prevention => Topic started by: MartinCCSS on April 22, 2025, 10:08:35 PM

Title: Surricata IDS/IPS rule to CSV
Post by: MartinCCSS on April 22, 2025, 10:08:35 PM
I would find it helpful if could export the 'Rules' tab to CSV listing which rules are enabled.  Mostly for comparing the rules on different firewalls, which is something I find myself wanting when reviewing the rules on multiple firewalls.
Title: Re: Surricata IDS/IPS rule to CSV
Post by: AishaHarvey on April 24, 2025, 09:49:50 AM
Quote from: MartinCCSS on April 22, 2025, 10:08:35 PMI would find it helpful if could export the 'Rules' tab to CSV listing which rules are enabled.  Mostly for comparing the rules on different firewalls, which is something I find myself wanting when reviewing the rules on multiple Geometry Dash (https://geometrydash-lite.io) firewalls.
Hi MartinCCSS!
You can try OPNsense has official REST API to get firewall configuration, in which can access rule list. I'm not sure, hope it helps!
Title: Re: Surricata IDS/IPS rule to CSV
Post by: someone on May 06, 2025, 07:45:59 PM
Different rulesets are not compatible, say snort and opnsense. You can manually download the rules via sftp into the router.
Title: Re: Surricata IDS/IPS rule to CSV
Post by: MartinCCSS on May 09, 2025, 10:57:57 PM
Quote from: AishaHarvey on April 24, 2025, 09:49:50 AM
Quote from: MartinCCSS on April 22, 2025, 10:08:35 PMI would find it helpful if could export the 'Rules' tab to CSV listing which rules are enabled.  Mostly for comparing the rules on different firewalls, which is something I find myself wanting when reviewing the rules on multiple Geometry Dash (https://geometrydash-lite.io/) firewalls.
Hi MartinCCSS!
You can try OPNsense has official REST API to get firewall configuration, in which can access rule list. I'm not sure, hope it helps!

Thanks for the suggestion. I'm not sure if the suggestion will be useful yet, since I'll need to learn REST APIs first, but I notice that Suricata / Intrusion Detection doesn't seem to missing from the REST API documentation. Correction, I found the it in the reference.

I wonder if Suricata has any command line options that I can use.