Home
Help
Search
Login
Register
OPNsense Forum
»
English Forums
»
Intrusion Detection and Prevention
»
ET Pro Telemetry rules not loading
« previous
next »
Print
Pages: [
1
]
Author
Topic: ET Pro Telemetry rules not loading (Read 2834 times)
r111
Newbie
Posts: 2
Karma: 1
ET Pro Telemetry rules not loading
«
on:
July 07, 2021, 05:10:30 pm »
I'm trying to get the ET Pro Telemetry rules to load. I have enabled Intrusion Detection, IPS mode, Promiscuous mode, Hyperscan, and chosen the LAN and WAN interfaces (I understand this is how to do it when VLANs are in use). I have installed the os-etpro-telemetry plugin and entered my et_telemetry.token. Under "Download" I have selected all of the ET telemetry rules and enabled them.
When I press "Download & Update Rules" it spins for a bit and then stops. No rules appear under the Rules tab. The Suricata log file (Services > Intrusion Detection > Log File) shows this:
2021-07-07T10:46:34 suricata[83728] [100170] <Notice> -- rule reload complete
2021-07-07T10:46:34 suricata[83728] [100170] <Warning> -- [ERRCODE: SC_ERR_NO_RULES_LOADED(43)] - 7 rule files specified, but no rule was loaded at all!
2021-07-07T10:46:34 suricata[83728] [100170] <Notice> -- rule reload starting
The system log (System > Log Files > General) shows the following:
2021-07-07T10:46:34 /rule-updater.py[4309] version response for
https://opnsense.emergingthreats.net/api/v1/ruleset/version
: {"ruleset": "opnsense-rules.tar.gz", "version": "9790"}
So it looks like it's downloading something, but Suricata is not receiving any rules. Can anyone help me figure out what's going on here? Thanks.
Logged
r111
Newbie
Posts: 2
Karma: 1
Re: ET Pro Telemetry rules not loading
«
Reply #1 on:
July 07, 2021, 10:47:45 pm »
This is now resolved.
After experimenting around I tried subscribing to Snort and loading their rules instead. Those wouldn't load either. This suggested to me that it was not a problem with a particular ruleset or source of rulesets. In the end what helped was to go to the Download tab, check all the rulesets I had enabled and choose "Disable selected". I did this and many more rulesets suddenly showed up in the Download list, including both ET Telemetry and Snort rules. I selected some, then pressed "Save" and "Download & Update Rules", and now I have more rules than I know what to do with.
I guess something had become corrupted in the list of available rulesets. Disabling all of them seemed to fix that so I could start again.
«
Last Edit: July 07, 2021, 10:50:20 pm by r111
»
Logged
Technoprenerd
Newbie
Posts: 1
Karma: 0
Re: ET Pro Telemetry rules not loading
«
Reply #2 on:
December 19, 2022, 05:56:10 pm »
Replying for future reference for the community:
The manual states that first the ET Telemetry Token needs to be registered, so paste that into the token field and hit "SAVE" first.
Only afterwards, the updated&download button
(verify that you've got the token in the code by command: grep 'et_telemetry.token' /usr/local/etc/suricata/rule-updater.config). If after a page reload the token is not there, then there is an error (which you can confirm by the following command: configctl template reload OPNsense/IDS).
Mine showed OK and with the SAVE button it was good.
Logged
Print
Pages: [
1
]
« previous
next »
OPNsense Forum
»
English Forums
»
Intrusion Detection and Prevention
»
ET Pro Telemetry rules not loading