Threats from abuse.ch / URLhaus not generating alerts
Threat intelligence feeds from abuse.ch / URLhaus are not generating alerts.
I have enabled abuse.ch / URLhaus and configured all associated rules to generate alerts.
Example:
SID: 81873344
URL: https://urlhaus.abuse.ch/url/1010244/
Test performed:
curl https://pastebin.com/raw/beW39LtA --output bull.shit
This activity does not generate any alert in Suricata.
curl http://testmyids.com Works Ok.
However, Microsoft Defender on my PC does generate an alert for the same test.
Found the solution.
Does not detect https