suricata rules not updating

Started by ascii, April 24, 2020, 06:34:42 PM

Previous topic - Next topic
i'm on 20.1.5

suricata is not updating rules for 2 days now. at least the ET open rules. abuse.ch are working.
i tried to enable Opnsense and nonfree. but the error in the Gui shows and the rules don't get downloaded.

when i try to do it via gui i get the error
Error reconfiguring IDS
Error (1)


in the logiles i see this quite often
2020-04-24T18:17:56 suricata: [100543] <Notice> -- all 4 packet processing threads, 4 management threads initialized, engine started.
2020-04-24T18:17:35 suricata: [100543] <Warning> -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'ET.eduphish' is checked but not set. Checked in 2025114 and 0 other sigs
2020-04-24T18:17:35 suricata: [100543] <Warning> -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.MS.XMLHTTP.no.exe.request' is checked but not set. Checked in 2022053 and 0 other sigs
2020-04-24T18:17:35 suricata: [100543] <Warning> -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.MS.XMLHTTP.ip.request' is checked but not set. Checked in 2022050 and 1 other sigs
2020-04-24T18:17:35 suricata: [100543] <Warning> -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'ET.wininet.UA' is checked but not set. Checked in 2021312 and 0 other sigs
2020-04-24T18:17:35 suricata: [100543] <Warning> -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.WinHttpRequest' is checked but not set. Checked in 2019822 and 1 other sigs
2020-04-24T18:17:35 suricata: [100543] <Warning> -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'HTTP.UncompressedFlash' is checked but not set. Checked in 2018428 and 1 other sigs
2020-04-24T18:17:35 suricata: [100543] <Warning> -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.http.PK' is checked but not set. Checked in 2017670 and 1 other sigs
2020-04-24T18:17:35 suricata: [100543] <Warning> -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'ET.JS.Obfus.Func' is checked but not set. Checked in 2017246 and 0 other sigs
2020-04-24T18:17:35 suricata: [100543] <Warning> -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'ET.Socks5.OnionReq' is checked but not set. Checked in 2027704 and 0 other sigs
2020-04-24T18:17:35 suricata: [100543] <Warning> -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'ET.smb.binary' is checked but not set. Checked in 2027402 and 4 other sigs
2020-04-24T18:17:35 suricata: [100543] <Warning> -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'ET.armwget' is checked but not set. Checked in 2024241 and 1 other sigs
2020-04-24T18:17:35 suricata: [100543] <Warning> -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'min.gethttp' is checked but not set. Checked in 2023711 and 0 other sigs
2020-04-24T18:17:35 suricata: [100543] <Warning> -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'ET.autoit.ua' is checked but not set. Checked in 2019165 and 0 other sigs
2020-04-24T18:17:35 suricata: [100543] <Warning> -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.MCOFF' is checked but not set. Checked in 2022303 and 0 other sigs
2020-04-24T18:17:35 suricata: [100543] <Warning> -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'ETPRO.RTF' is checked but not set. Checked in 2020700 and 0 other sigs
2020-04-24T18:17:35 suricata: [100543] <Warning> -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'ET.MSSQL' is checked but not set. Checked in 2020569 and 0 other sigs
2020-04-24T18:17:35 suricata: [100543] <Warning> -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.DocVBAProject' is checked but not set. Checked in 2020170 and 0 other sigs
2020-04-24T18:17:35 suricata: [100543] <Warning> -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'ET.ELFDownload' is checked but not set. Checked in 2019896 and 0 other sigs
2020-04-24T18:17:35 suricata: [100543] <Warning> -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'ET.http.javaclient.vulnerable' is checked but not set. Checked in 2013036 and 2 other sigs


attached a could of screenshots of my config

looks like the DNSBL is blocking the update
just not sure which rule it is